First, map clearly how data leaves its original scope of control
Do not look only at where the servers are located. Registration pages, identity verification SDKs, customer service backends, cloud backups and remote access by overseas teams may all form cross-border processing chains. You should record the data source location, recipients, access locations, purposes and retention periods, and distinguish between situations where the platform determines the purpose and situations of entrusted processing; the same vendor may also assume different roles for different purposes.
Mainland outbound transfer mechanisms have conditions and exceptions
The 2024 regulations of the Cyberspace Administration of China and the accompanying press conference adjusted the applicable conditions for assessments, standard contracts and certification. For example, where necessary for concluding or performing a contract to which an individual is a party, cross-border payment information may qualify for a specific mechanism exemption, but not all corporate account-opening materials can be fitted into that exception. Whether sensitive personal information or important data is involved, and whether the entity is a critical information infrastructure operator, will affect the analysis; exemption from a particular mechanism does not mean exemption from other obligations such as necessity, notification and security protection.
Hypothetical scenario: an overseas corporate client still involves personal information
Assume the platform serves an overseas trading company, and the uploaded documents include a director's passport, a mainland finance employee's mobile number and account information. The fact that the contractual client is a legal person does not mean the entire package of materials is outside the scope of personal information rules; nor does the fact that the documents have been desensitized mean they are completely anonymous. Under Articles 4 and 73 of the Personal Information Protection Law, de-identified data that can be used, with additional information, to re-identify an individual may still constitute personal information.
Keep cooperation contracts consistent with system configurations
In practice, unnecessary fields requested by banks or vendors can first be deleted, and then the purposes of use, sub-entrustment, access permissions, incident notification, deletion and return should be agreed. Information that anti-money laundering requirements require to be retained may conflict with a client's deletion request; the lawful retention scope should be determined rather than promising deletion of everything at any time. If other markets are involved, local privacy and international transfer requirements should be verified separately; data compliance also cannot provide legitimacy for crypto payment business that may not be carried out in the first place.
When selecting an identity service provider, you can also ask whether it will use customer identity documents for independent model training, product improvement or other commercial purposes, as these uses may not fall within the original entrusted verification scope. Writing the contract as processing solely for the platform while allowing the vendor to retain and reuse data on its own will cause the arrangement to be inconsistent with the facts. The actual uses should be assessed by privacy professionals; fields that need not be transmitted should not be transmitted; secondary uses that cannot be shown to be necessary should not be enabled by default; and configurations and vendor responses should be retained.
Recommended actions
- Establish a field-level data inventory, distinguishing personal information, sensitive information and possible important data.
- Verify the actual access locations and sub-entrustment chains of cloud providers, verification providers and banks.
- Before launch, determine the applicable cross-border transfer pathway, the necessity justification, and the retention and deletion rules.
This content is for general information only and does not constitute legal advice. Please consult a qualified lawyer about specific matters.
References
- Questions and Answers on the Provisions on Promoting and Regulating Cross-Border Data Flows — Cyberspace Administration of China
- Cyberspace Administration of China Publishes the Provisions on Promoting and Regulating Cross-Border Data Flows — Cyberspace Administration of China
- Personal Information Protection Law of the People's Republic of China (Articles 4 and 73) — Standing Committee of the National People's Congress, published on the official website of the Cyberspace Administration of China
