SIMIC

The Cyberspace Administration of China (CAC) published a set of draft guidelines that lay out when and how companies should get the agency's approval before sending data out of China.

Under the proposed guidelines, a government review is mandatory if the data exporter handles any personal information of more than 1 million Chinese residents or the "sensitive" personal information of more than 10,000 people.

A green light is also needed if the data transfer is carried out by critical information infrastructure operators or any firms that need to transfer important data.

There is some worry that they will drive up compliance costs for international businesses working in China.

Since coming into force in 2017, the Cybersecurity law compels data exporters to go through security assessments by the government.

The new rules also encourage a self-review of data transfer risks.