AG真人国际-(china)官方网站

Under traditional M&A transaction due diligence, we generally focus only on seller side for a comprehensive due diligence, which includes legal, financial, and operational due diligence. We seldom do reverse due diligence on buyer side, and usually limited due diligence on buyer to basic background and financial purchasing power. However, under the Chinese data legislation system, the buyer also needs to cooperate with the seller to assess its level of data security and privacy protection to ensure that the buyer is capable of undertaking and protecting data security and personal privacy interests after the transaction.

According to the Measures for Data Security Management in the Industrial and Information Technology Sector (for Trial Implementation) (issued by the Ministry of Industry and Information Technology on December 6, 2022), Article 22 provides that where a data processor in the industrial and information technology sector “needs to transfer data due to merger, reorganization, bankruptcy, or other reasons, it shall formulate the data transfer plan.” The formulation of a data transfer plan inevitably requires due diligence on the buyer's capacity to take over the data. This is therefore a distinctive feature from traditional due diligence work. 

For a typical cross-border M&A, the parties to the transaction may be subject to different jurisdictions' protection of data security and privacy, and there is a possible conflict of laws on different data protection laws. Assuming that the Seller of our transaction is a company in the EU and the Buyer is from China, and the data of a UK company, processed by the Seller, is stored in the EU. The buyer needs to comply with the requirements of the EU GDPR. To transfer the data to the Chinese Buyer outside of the EU, the Chinese buyer needs to sign the EU Standard Contractual Clause (SCC). For the Buyer, receiving information and data from outside China does not fall under the jurisdiction of Chinese data law, thus the Buyer generally only needs to comply with the EU SCC. However, even according to GDPR, the Chinese Buyer needs to cooperate with the EU Seller to provide relevant information and data to show its capacity to comply with the EU SCC, and if the personal information controlled by the Chinese Buyer is involved and needs to be transferred outside of China, then based on the specific situation, the Chinese Standard Contract for Cross-border Transfer of Personal Information (China SCC) or the Security Assessment of Outbound Data Transfers should be handled. 

There are indeed incompatibilities between the EU SCC and the Chinese SCC, such as dispute resolution and applicable law. For a UK buyer and a Chinese buyer, both of whom have signed both the EU SCC and the Chinese SCC, will there be a conflict between the two SCCs? Indeed, there will be conflicts regarding the content of the two SCCs; however, no conflicts will be found regarding the applicability of the SCCs. For data regulatory requirements in different jurisdictions, the applicable rules should be determined based on the source of the data. As such, for data from China, the Chinese data law applies; for data from the EU, the EU data law applies.