Enterprise VPN Compliance Checklist: Practical Recommendations for China's Data Export Security Assessments

1. Background and Key Compliance Points

With the implementation of the Data Export Security Assessment Measures and the Personal Information Protection Law (PIPL), enterprises using VPNs for cross-border operations must address data export compliance. VPNs themselves are not directly regulated, but the cross-border data they carry may trigger security assessment obligations. Enterprises should conduct self-assessments from the following dimensions.

2. VPN Deployment Model and Data Flow Audit

1. Deployment Model: Determine whether the VPN is self-built or procured from a third party. For self-built VPNs, verify the physical location of servers (domestic/overseas). For third-party services, confirm the provider holds legitimate licenses (e.g., MIIT VPN license).
2. Data Flow: Create a data flow diagram to identify which data is transmitted overseas via VPN. Focus on: employee personal information, customer data, and business operational data (e.g., transaction records, logs).
3. Data Classification: Classify data according to the Data Security Law, identifying important data and personal information. If important data is exported, a security assessment is mandatory.

3. Log Retention and User Notification

1. Log Retention: VPN logs (connection time, source IP, destination IP, traffic volume) must be retained domestically for at least 6 months (per the Cybersecurity Law). Ensure logs are not automatically synced to overseas servers.
2. User Notification and Consent: If VPN is used for remote work, clearly disclose data export in employee handbooks or privacy policies and obtain consent. For customer data, include data export clauses in service agreements.
3. Minimization Principle: Only transmit data essential for business operations; avoid bulk transfer of unnecessary personal information.

4. Triggers for Security Assessment and Countermeasures

According to the Data Export Security Assessment Measures, the following scenarios require a security assessment:

• Export of important data;
• Export of personal information by operators processing the personal information of more than 1 million individuals;
• Cumulative export of personal information of more than 100,000 individuals or sensitive personal information of more than 10,000 individuals since January 1 of the previous year.

Recommendations:

• Maintain a data export ledger recording data type, volume, and recipient for each transmission.
• Collaborate with legal teams or external counsel to assess whether filing obligations are triggered.
• If triggered, prepare assessment materials in advance, including a self-assessment report on data export risks and a description of data processing activities.

5. Contracts and Third-Party Management

1. Contract with VPN Provider: Specify the provider's data processing obligations, data security responsibilities, and breach penalties. Require security certifications (e.g., ISO 27001).
2. Contract with Overseas Recipient: Per PIPL Article 38, define the purpose, method, and scope of processing by the overseas recipient, and clarify their legal liability. Consider adopting Standard Contractual Clauses (SCCs).

6. Regular Audits and Training

1. Regular Audits: Conduct compliance audits of VPN usage every six months, checking data flow, log retention, and user permissions.
2. Employee Training: Train employees involved in cross-border data transfers on compliance requirements, emphasizing the data minimization principle and consequences of violations.

By following this checklist, enterprises can systematically identify VPN-related data export risks and take appropriate measures to ensure compliance.