Under the new rules Chinese NPOs holding more than 1 million individuals’ personal information must apply for a cybersecurity review prior to listing abroad.

Key Points:

..Chinese network platform operators (NPOs) holding personal information of more than 1 million users must apply for a cybersecurity review from the Cyberspace Administration of China (CAC) before being “publicly listed abroad.” Draft guidance issued by the Chinese authorities also echo this cybersecurity review / data security assessment requirement.

..The CAC can initiate a cybersecurity review, presumably against any entity, if it deems that the entity’s data processing activities or products and services will or may affect national security.

..The cybersecurity review may take 70 working days or, in exceptional cases, 160 working days or even longer.

..NPOs that plan to list in Hong Kong are unlikely to be required to apply for a cybersecurity review.