However this provision is open to interpretation and may be understood to apply only to an entity which outsources the data processing in the first instance.

FORBES: China: Seeking Balance In Regulating Data Privacy