International businesses that process data from China should obtain user consent and establish a data map, specifically looking at cross-border flow and residency, to ensure compliance even as more clarity is needed on China’s Personal Information Protection Law.