Related guide collections
Continue with coordinated practical guides and primary resources.
Updated 2026 MNC HR/CRM data guides
National L3 — Data Privacy & Cybersecurity
Key Principles
- Consent � Separate, informed consent required for most processing
- Purpose limitation � Data must be processed only for specified purposes
- Data minimization � Collect only data necessary for the purpose
- Transparency � Clear privacy policies required
Cross-Border Data Transfer
Three mechanisms for transferring personal data out of China: (1) security assessment by CAC (for critical data operators), (2) standard contractual clauses (SCCs) with the data subject, (3) certification by a recognized body.
Penalties
Fines up to RMB 50M or 5% of prior year revenue for serious violations. Individuals can claim damages. Class actions are available through consumer associations and????.