Chinese regulators released new requirements this week for certifying cross-border transfers of personal information. The rules require “non-critical information infrastructure operators” to obtain certifications before transferring certain data across borders.The framework aims to protect personal information rights and facilitate secure cross-border data flows, according to statements from China’s cyberspace and market regulators, news agency Reuters reported. The new rules take effect January 1, 2026.
China fines Dior for ‘mishandling’ customer data
Last month, Chinese police fined the Shanghai subsidiary of the French fashion house Dior after finding the company guilty of transmitting customer data overseas without mandated security screening, according to state media. The investigation, which was conducted by the cyber police, was initiated following media reports of a data breach at the brand as Chinese users received alert text messages from Dior. Citing the National Cybersecurity Notification Centre, state news agency Xinhua reported that the findings indicated multiple violations of China’s Personal Information Protection Law by Dior Shanghai.
The violations specified by the cyber police included:
Unauthorised data export: Sending the personal data of customers in China to the Dior headquarters in France without first carrying out a required data export security assessment.Lack of compliance: Failing to establish a standard contract for such data export or failing to obtain a personal information protection certification.Insufficient customer consent: Failing to fully inform customers about how their personal information would be used by the French headquarters.Consent violation: Failing to obtain customers’ “separate consent” for the data transfer to France.
