New data security laws in China are increasing the cost of doing business in the country and making cross-border litigation more challenging, according to a new analysis.
In 2021, China implemented the Personal Information Protection Law (PIPL) and the Data Security Law (DSL), requiring international and domestic companies to re-evaluate how they handle Chinese personal data.
The PIPL sets how data is collected, stored and handled in mainland China. Additionally, it establishes data processing requirements and mandatory approval of data transfers by Chinese authorities if the data is requested by a foreign judiciary.
For multinational companies, the law also demands certain data protection certifications.
“Both the PIPL and DSL give China more teeth to enforce its position that data cannot be transferred out of the country without expressed permission,” said Davin Teo, head of Asia forensic technology at Alvarez & Marsal.
In the past 12 months, Alvarez and Marsal’s Disputes and Investigations Forensic Technology team has seen a 20% increase of engagements concerning cross-border disputes involving China, Teo said.
“The new laws are more of a speed bump than a wall,” he said. “While the PIPL adds hoops to go through in dispute, investigation or litigation processes,” the barriers are not “insurmountable”, he said.
Together, with the need to appoint local governance staff, compliance costs are likely to rise steeply, he said. “However, these pale in comparison to the hefty penalties facing companies and individuals that violate the laws for non-compliance.”
Alvarez & Marsal also noted that aggressive enforcement by the US would boost the number of cross-border investigations. “This is particularly an issue for cross-border transactions in China,” Keith Williamson, the firm’s head of Asia disputes and investigations, said.
“There is renewed focus in the US administration’s handling of corruption,” he said. “In Asia, the majority of investigations will focus on companies with operations in mainland China. Indonesia, Vietnam and Thailand.”
Williamson said the most vulnerable industries will continue to be those that are government-regulated, including oil and gas, aerospace and defence and healthcare.
- George Russell