The CAC Assessment Collection – Part 3: Steps and Timeline of a CAC Assessment

In our previous posts, we discussed what data export activities are subject to scrutiny assessment (CAC Assessment) conducted by the Cyberspace Administration of China (CAC) (see Part 1) and examined what companies must do before submitting a CAC Assessment application (see Part 2). In the last article of our CAC Assessment series, we will address the procedures and timeline of a CAC Assessment, the circumstances that trigger a renewal or reapplication of a CAC Assessment, and the consequences of noncompliance.

What are the procedures and timeline of a CAC Assessment?

The CAC Assessment could take a considerable amount of time. The table below provides a sample timeline for the assessment process based on what is provided for in the Measures for Security Assessment of Data Exports (Measures) and the Guidelines on Application of Security Assessment of Data Exports (First Version) (Guidelines):

As noted above, it will take time for a data controller to conduct a self-assessment, negotiate a Legal Document with an overseas recipient, and complete a CAC Assessment application form before it can submit an application for a CAC Assessment. It is also possible that the CAC will ask for additional information and documents during the formal assessment process, which could extend the review period from the standard period of a maximum of 57 business days to a longer term. Considering all these factors, the entire CAC Assessment could take longer than three months to complete.

If a data controller has any objection to the assessment result, the data controller may apply for a reassessment within 15 business days of the date of receipt of the assessment result to the CAC, and the result of the reassessment is final.

Renewal of assessment upon the expiration of the two-year term

The CAC Assessments, once cleared, will be valid for two years. If a data controller intends to continue to export data, a renewal application must be submitted 60 business days prior to the expiration of the two-year term of validity.

Circumstances that could trigger re-application before clearance expiration

There are certain circumstances under which a data controller may be required to undergo additional CAC Assessments before the initial clearance expires. For instance, if a company attempts to acquire a target company that engages in data export activities that must be cleared by a CAC Assessment, the target company may need to obtain additional CAC clearance if there is a change in control. This point is particularly important to consider moving forward in change in control transactions in China, and obtaining clearance via an additional CAC Assessment should be an important closing condition in these types of transactions.

Additionally, a data controller could be required to re-apply for a security assessment if there is:

• Any change in the purpose, processing method, scope, or type of the data which affects the security of the exported data, or any change in the retention period of personal data or important data;
• A change in the regulations or cyber security conditions of the home country or region of the data recipient, and a change in the Legal Document between the data controller and the data recipient, in each case affects the security of the transferred data; or
• Other circumstances affecting the security of the exported data.

Suspension of data transfer due to noncompliance

A data controller is required to comply with data transfer regulations on an on-going basis; otherwise, the CAC could order the data controller to suspend all data transfers.

More specifically, after obtaining a clearance from the CAC, the data controller should comply with data export security management requirements on an on-going basis. If the CAC determines that a data controller fails to meet the data export security management requirements after the clearance, the CAC has the power to order the data controller to suspend the data transfer.

Takeaways

Act Now

The Measures have taken effect from 1 September 2022. For data exported before 1 September 2022, data controllers are given a six months grace period to rectify any noncompliant activities pertaining to data exporting. Given time is necessary to complete a standard CAC Assessment, data controllers that are subject to the CAC Assessment must act now to prepare and submit the application before 1 March 2023.

Localization or Anonymization as Alternatives

For a data export activity that requires a CAC Assessment, companies should consider the time and resources required for it to go through the CAC Assessment and the likelihood for it to obtain clearance from the CAC. Companies may also consider whether it is possible to localize the data or anonymize the personal information involved before a data export activity as options just in case the CAC Assessment is not available.

If you have any questions regarding the issues discussed in this alert including data privacy-related issues, our Global Data Protection team, which includes lawyers across our Greater China region offices, is available to assist with legal and compliance advice, including risk assessments and reviews.