The 1.3 Million Player Question

The mechanism is the CAC security assessment, not the standard contract. Under PIPL Articles 38 and 40, and the March 2024 cross-border provisions, a handler must apply for security assessment if it exports PI of more than 1,000,000 people cumulatively since January 1 of the current year, or sensitive PI of more than 10,000 people, or important data. Starfall has exported data of 1.3 million unique domestic players in the year. The count is people, not records, so its “records” argument fails. Pseudonymized device IDs and gameplay logs remain PI if they can be linked to individuals, directly or indirectly; only irreversible anonymization removes the data from PIPL. The standard contract route is limited to 100,000 to 1,000,000 people of ordinary PI, or fewer than 10,000 people of sensitive PI, and it is not available above the assessment threshold. Filing a standard contract when the assessment threshold is crossed is not a valid workaround and can lead to rejection and enforcement. Starfall should self-assess, prepare the assessment materials, obtain separate consent and Article 39 notice, complete a DPIA, and file with the CAC. The assessment result is valid for two years, with a possible extension. The free trade zone negative list does not help because Starfall is not in a free trade zone.

Remote access from Manila is a cross-border transfer even though the database sits in Beijing. PIPL looks at whether the data is provided to an overseas recipient, and overseas staff access is a provision. The 60 Manila staff should be included in the scope of the assessment, the recipient list, the access controls and the contracts. If they can see the 1.3 million domestic players' data, that access reinforces the security assessment trigger and cannot be treated as an internal matter. The Southeast Asian transit data is different. The 2024 provisions exempt data collected and generated outside China that is transferred through China without processing domestic PI or important data. If Starfall only routes the packets through Beijing and does not store, analyze or mix them with domestic data, the transit may qualify for the exemption. The company should segregate the traffic, document the technical architecture, and ensure no domestic PI is processed in the same environment. If the Beijing route includes analytics, storage or customer support work on that data, the exemption is lost. The company should also check whether the Singapore vendor's access to the Southeast Asian data creates a separate transfer. Keep a data-flow map and records of the exemption analysis.

Starfall should not send the data directly. DSL Article 36 provides that, without approval by the competent Chinese authorities, no organization or individual may provide data stored in China to foreign judicial or law enforcement authorities. The Singapore regulator's request is a foreign law enforcement request. The data is stored in Beijing, so Article 36 applies. Starfall should acknowledge receipt without waiving rights, preserve the data, and immediately escalate to Chinese counsel and the competent authorities, likely the CAC and public security. It should ask the Singapore regulator for the legal basis, scope and urgency, and explain that Chinese law requires an approval or mutual legal assistance channel. If the request can be narrowed or satisfied with aggregated, non-personal data, that may be preferable, but it still needs legal review. Starfall should not rely on the Singapore vendor to respond on its behalf, because that could become an indirect provision. It should also check its contracts for government-access clauses and notify affected players if required. The board should understand that compliance with a foreign order without Chinese approval can create liability under the DSL and PIPL, while refusing in the wrong way can create foreign-law exposure; the safe path is formal authorization.