The Cyberspace Administration of China published a Q&A related to administrative policies on the security of cross-border transfers. One topic involves understanding the necessity of cross-border transfers. Pursuant to Articles 6 and 19 of the Personal Information Protection Law, the considerations for determining “necessity” include whether the processing of personal information is directly related to the purpose of the processing; has minimal impact on individuals rights; is limited to the minimum scope necessary to achieve the purpose; and the retention period is limited to the shortest time necessary to achieve the purpose.
