Advertisement

Navigating data compliance is becoming a bigger challenge for businesses amid increased scrutiny

  • As China’s economy continues to digitalise at a rapid pace Beijing is seeking to build a robust data governance regime
  • Companies need to make sure they have good data management infrastructure in place, which allows them to keep Chinese data in China

Reading Time:3 minutes
Why you can trust SCMP
As data regulation becomes more complex in China, companies must ensure they have the right infrastructure in place. Photo: Xinhua

Businesses are finding ways to navigate through a more complicated regulatory environment in mainland China and Hong Kong, as the Covid-19 pandemic forced all kinds of activities online, according to experts on Thursday at the South China Morning Post’s China Conference.

Advertisement

“We expect more laws coming in,” said Fuller Yu, chief information security officer at Hong Kong’s Hospital Authority. “Because number one, [data privacy] awareness from users [is increasing], and also, all countries are aware of their data as a critical asset and [are giving it] more protection.”

As China’s economy continues to digitalise at a rapid pace, Beijing is seeking to build a data governance regime that can strike a balance between unleashing the value of that data on the one hand with careful government scrutiny of how businesses handle personal data on the other.

A new national law that was passed last week, the Data Security Law, sets forward hefty punishments for companies that fail to protect their data, including those who fail to prevent large scale data leaks, and those that transfer the state’s “core data” overseas without Beijing’s approval. Companies that hand over “important data” to a foreign judiciary or law enforcement agency without approval will face a heavy penalty under the new law. 

Advertisement
While no definition was given for “important data,” and only a broad definition was given of what counts as the country’s “core data,” the law also urges the establishment of a data categorisation system that will help determine the difference between the two, and what kind of data will be encouraged to circulate without restrictions.
Advertisement