Sharing|China eCommerce Cloud Hosting: Challenges and Solutions

Violators could receive fines up to 2 million RMB and even have their business license revoked. Therefore, international brands and companies already look for localized China eCommerce cloud hosting solutions.

This is especially necessary since many international brands use internationally oriented cloud ecommerce hosting providers. Global eCommerce hosting solutions such as Salesforce Commerce Cloud, Shopify Plus or Magento Cloud Commerce are hosted overseas. Under the new laws, there might be legal implications if international companies use these platforms in China.

To help you prepare, we provide an overview of challenges and solutions you will face. These tips and info apply to companies who:

1. Already have a website adapted to the Chinese market in terms of language, international payment methods etc. but are hosted overseas

2. Already developed and launched a Chinese localized eCommerce website, which is hosted in China, but need to transfer data to overseas headquarters for global management

3. Want to setup and launch a Chinese localized eCommerce website and host in Mainland China

If you are starting in China eCommerce, it is important to carefully choose a hosting solution. If you already are active on the market as in situation 1 but you turn out not to be fully compliant, your website could be blocked for Chinese access.

Thus, for those in situation 1 and 3, you might face the following challenges.

All sites hosted on a Mainland China server must have an ICP Bei’an by law. However, for setting up a store on Tmall or JD.com, you do not need an ICP Bei’an.

ICP Bei’an is the process of obtaining a business Internet Content Provider registration number that allows you to host your website on a Mainland Chinese server. When applying for an ICP Bei’an, besides a Chinese domain and local hosting, you also need a business license.

Besides legal compliance, you need an ICP Bei’an for Baidu Pay-Per-Click campaigns and other marketing tools, like WeChat and Alipay integration.

If your website does not have an ICP Bei’an, your hosting provider will not allow your website to be accessible. Furthermore, if your website is live without an ICP Bei’an, you may get blocked, face harsh fines or even a permanent online blackout in China.

Be aware that according to the new China eCommerce Law, it is mandatory for any eCommerce brand website to have the ICP Bei’an and other relevant certifications clearly shown on the website. Authorities can fine up to 500.000 RMB for any violations.

*Relevant clauses of the new China eCommerce Law: 15, 76, 81

To obtain ICP beian, you first need to register a Chinese domain and ensure that your website is hosted in Mainland China.

Both things need to be set up before you can practically and legally move on to the development stage. Even more importantly, you need both to apply for an ICP Bei’an. For this reason, it is also crucial that the domain registration applicant’s name is the same as the one filing for the ICP Bei’an. Forgetting to do this will complicate the process and result in serious delays.

Many international companies host overseas, so it would seem natural to store personal user data abroad. However, if website and cloud are not hosted in Mainland China, such transfer of information could constitute a cross-border data transfer. Furthermore, transfer of personal information to a cloud is likely to be regarded as a ‘use’ of personal information which requires explicit consent.

Under the Cyber Security Law, it is required that all data that is collected in China is stored locally. If there are specific reasons that make it necessary to have overseas data storage, you need to pass a safety assessment by the Cyberspace Administration of China (CAC). For any violations, the penalty could as high as 500.000 RMB and in serious cases your business license might be invoked.

Companies still have until December 31, 2018 to ensure compliance with the cross-border data flow requirements as stated above.

*Relevant clauses of the China Cyber Security Law (in Chinese): 37, 66

The new China eCommerce law requires that eCommerce operators record and store the platform’s product, service and transaction data. They also need to ensure its completeness, security and usability. All data should be traceable for at least 3 years. Under serious circumstances, authorities may impose a fine of 500.000 RMB.

This of course increases the burden on enterprises’ IT technology and data storage. So companies might have to improve key aspects such as server deployment, software security and IT manpower. Additionally, in recent years companies are increasingly using the cloud to host and store data. Outsourcing data storage to third parties can lower the burden on one’s own operations. Furthermore, companies can easier comply with the law and avoid legal risks through these professional data security and cloud hosting services.

*Relevant clauses of the China eCommerce Law (in Chinese): 31, 80

Under the new China eCommerce law, whenever a company collects data and uses this information it should clearly state its purpose, method and scope. Additionally, it must obtain consent of the user. Other website policies such as cookies and privacy policies require the same.

Of course, companies are not allowed to disclose, falsify or damage any of the personal data they collect. Companies also need to guarantee user data security. Individuals also have the right to request changes or deletion of their data.

Violation of this rule will result in confiscation of any illegally obtained gains. Furthermore, authorities may impose a fine between 2 to 10 times as much as the amount of the illegal gains. Should there be no illegal gains, the highest fine could be 1 million RMB. If authorities find the circumstances serious enough, they can revoke the business license.

*Relevant clauses of the China Cyber Security Law (in Chinese): 41, 42, 43, 44, 64

Article 38 of the China Cyber Security Law requires enterprises to conduct annual assessments of their network safety and risks. This can be either done internally or by hiring a cybersecurity agency. Furthermore, it is necessary to ensure that the assessments and any possible improvements are sent to relevant government departments.

Article 34 states that companies are required to appoint special security and safety management supervisors (and need to conduct security background checks on them). Furthermore, there should be a system in place for recovery and backup of important directories and databases.

Article 21 stipulates that enterprises should take technical measures to monitor and record network operations and security incidents. Additionally, relevant network logs should be saved for at least six months in accordance with regulations. Lastly, data classification and encryption need to be applied wherever necessary.

If any of the above are violated, you may face a fine ranging from 10.000 to 1 million RMB.

Naturally, companies can hire an experienced and professional third party for the security assessment, server operation and maintenance, disaster recovery systems and backups. Not only does this reduce the number of IT staff required, which saves a lot of labor costs, it also allows the existing staff to focus on other IT tasks.

*Relevant clauses of the China Cyber Security Law (in Chinese): 21, 34, 38, 59