China Cybersecurity Law (CSL) 39: Art. 39 Personal information and important data collected by CII operators stored within China; security assessment before any provision abroad

Personal information and important data collected or generated by CII operators during operations within China must be stored within China; where provision abroad is truly necessary for business, a security assessment is conducted under the measures of the national cyberspace affairs departments and the State Council departments, unless laws or administrative regulations provide otherwise. As amended, storing such information and data abroad or providing it abroad in breach of this article is handled and penalised under the relevant laws and administrative regulations (Article 71(3)).