Provisions on Promoting and Regulating Cross-border Data Flows

Build an inventory of outbound flows and triage each one. Flows within Art. 7 — a CIIO transferring personal information or important data; a non-CIIO transferring important data, or cumulatively transferring since 1 January of the current year the personal information of more than 1 million individuals (excluding sensitive data) or the sensitive personal information of more than 10,000 individuals — must go through the security assessment. Flows within the Art. 8 band — a non-CIIO cumulatively transferring since 1 January of the current year the personal information of at least 100,000 but fewer than 1 million individuals (excluding sensitive data), or the sensitive personal information of fewer than 10,000 individuals — must use the standard contract or certification. Volumes are counted cumulatively from 1 January of the current year, so the count must be tracked on a rolling monthly basis rather than assessed transfer by transfer.

Applies when

Every business transferring data abroad. Fast-growing consumer AI products in particular need thresholds monitored in advance, so they do not cross the one-million mark mid-year while still relying on a standard contract.

Evidence to retain

• · Inventory of outbound flows covering scenario, recipient, data categories, and whether sensitive personal information or important data is involved
• · Rolling monthly counts of cumulative individuals transferred, with the counting methodology
• · Route determination for each flow (assessment, standard contract, certification or exemption) and the article relied on
• · Description of the threshold-proximity alerting mechanism and the alerts raised

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Where you rely on Art. 3 (data collected or generated in international trade, cross-border transport, academic cooperation, transnational manufacturing or marketing that contains no personal information or important data), Art. 4 (personal information collected abroad, transmitted into China for processing and then sent back out without introducing domestic personal information or important data), or any of the four cases in Art. 5 (a contract to which the individual is a party; cross-border HR management; an emergency to protect a natural person’s life, health or property; and a non-CIIO that has cumulatively transferred fewer than 100,000 individuals’ personal information, excluding sensitive data, since 1 January of the current year), produce a written justification at the time of the decision stating the limb relied on, the factual basis and the boundary conditions. Exemptions are self-determined rather than approved, so the burden of proof sits with the business if a regulator challenges them.

Applies when

Companies running an “onshore R&D, offshore operations” architecture (Art. 4); cross-border retail and payments (Art. 5(1)); groups reporting employee data to overseas subsidiaries (Art. 5(2)); and early-stage outbound companies below the 100,000-individual line (Art. 5(4)).

Evidence to retain

• · Written exemption justification per scenario, naming the limb, the factual basis, the boundary conditions and the review cycle
• · Field-level inventory and technical verification evidence supporting “contains no personal information or important data”
• · For Art. 4, evidence of the offshore origin of the data and a description of the processing chain showing no domestic personal information or important data was introduced
• · For Art. 5(2), the lawfully adopted labour rules and the lawfully concluded collective contract
• · Re-determination records where the basis for the exemption changed

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

Processors must identify and declare important data under the applicable rules. Where the relevant authority or region has not notified the processor, and has not publicly designated the data as important, the processor need not declare it as important data in an outbound security assessment. The rule leaves the final designation with the authorities, but the processor must still carry out and document the identification exercise; once notified or publicly listed, the outbound transfer of that data goes unconditionally through the security assessment route (Art. 37 of the Network Data Security Management Regulations).

Applies when

AI companies in embodied intelligence, autonomous driving, industrial and energy settings, whose high-definition maps, roadside and plant-environment captures and equipment telemetry are frequent candidates for sector important-data catalogues.

Evidence to retain

• · Working papers for the important-data identification, recording method, reviewers and conclusion date
• · Records of monitoring the sector and regional important-data catalogues
• · Archived copies of any notification from the authority or public designation received
• · Contingency plan for switching the outbound route if a designation is made

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

A processor transferring personal information abroad must perform the statutory duties of notice, obtaining separate consent and running a personal information protection impact assessment. These three duties sit outside the threshold triage: even where a flow is exempt under Arts. 3–6, if personal information leaves the country the separate consent in PIPL Art. 39 and the impact assessment in PIPL Art. 55 still apply, unless another statutory basis displaces consent. The processor must also discharge its data-security duties and, where a data-security incident occurs or may occur, take remedial measures and report promptly to the provincial or higher cyberspace authority and other competent departments.

Applies when

Every business transferring personal information abroad, including those relying on an exemption. This is the most common misunderstanding in practice: the exemption removes the assessment, contract or certification step, not the notice, consent and impact-assessment duties.

Evidence to retain

• · Text of the transfer-specific notice and evidence of how it is displayed
• · Separate-consent logs for the transfer, kept apart from general consent records
• · Personal information protection impact assessment report and evidence of three-year archiving
• · Incident reports for outbound data-security events and the receipts from the provincial or higher cyberspace authority

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Within the national data classification and grading framework, a free-trade zone may draw up its own list of data that must go through the security assessment, standard contract or certification (a negative list), approved by the provincial cybersecurity and informatisation commission and filed with the CAC and the national data administration. A processor inside the zone transferring data that is not on the negative list is exempt from the assessment, standard contract and certification. Site selection and entity structuring should take this into account, and the target zone should be checked for whether a list has been published and which sectors it covers.

Applies when

Outbound-facing companies considering establishing a data-processing entity or R&D centre inside a free-trade zone; coverage varies materially between zones and must be checked zone by zone.

Evidence to retain

• · Text of the target zone’s negative list and a note on its approval and filing status
• · Item-by-item comparison of the company’s data against the negative list
• · Registration and operating evidence for the in-zone entity, showing processing genuinely occurs inside the zone
• · Monitoring mechanism and review records for updates to the list

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)