Measures for Security Assessment of Outbound Data Transfers

Before applying, run a self-assessment covering six points: the lawfulness, legitimacy and necessity of the purpose, scope and method of the transfer and of the recipient’s processing; the volume, scope, categories and sensitivity of the data and the risks the transfer may create; whether the recipient’s undertakings and its management and technical capability can secure the data; the risk of tampering, destruction, leakage, loss, transfer or unlawful acquisition or use during and after the transfer, and whether individuals have a workable channel to protect their rights; whether the draft legal instrument adequately allocates data-security responsibilities; and any other matter bearing on the security of the transfer.

Applies when

Every processor required to file for an outbound security assessment. The self-assessment report is part of the application pack and is the first document called for in any subsequent interview or inspection.

Evidence to retain

• · Self-assessment report addressing each of the six points in Art. 5
• · Field-level inventory of the data to be transferred, tagged with category, volume and sensitivity
• · Due-diligence pack on the offshore recipient covering its jurisdiction’s legal environment, security capability and incident history
• · Register of risk-mitigation measures tied to the self-assessment conclusions
• · Internal approval records signed by legal, security and the business owner

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

Submit the application form, the self-assessment report, the draft legal instrument with the offshore recipient and any other materials the assessment requires (Art. 6). The provincial authority completes the completeness check within five working days of receipt, forwarding a complete pack to the CAC and returning an incomplete one with a single consolidated list of what is missing (Art. 7). Once the CAC accepts the filing it issues a written acceptance notice, and the assessment must be completed within 45 working days of that notice, extendable with notice where the case is complex or materials need correction (Art. 12). A party disputing the outcome may apply for re-assessment within 15 working days of receiving it, and the re-assessment result is final (Art. 13). The Measures themselves set no “decide on acceptance within N working days” rule; the acceptance-stage timetable sits in the CAC’s Application Guide for the Security Assessment of Outbound Data Transfers, whose text was not retrieved in this round, so no day count is stated here.

Applies when

Processors that meet the filing threshold — the operative threshold being Art. 7 of the Cross-border Data Flow Provisions, which supersedes Art. 4 of these Measures. Project plans should be back-scheduled from “preparation + 5 working days of provincial checking + acceptance + 45 working days of assessment” as a floor, not from a calendar-month estimate.

Deadline: Five working days for the provincial completeness check; 45 working days for the assessment, running from the written acceptance notice (extendable); re-assessment must be sought within 15 working days of receiving the result.

Evidence to retain

• · Archived application form and the complete submission pack
• · Completeness-check receipt from the provincial authority and the CAC’s written acceptance notice
• · Correspondence on any supplementary or corrected materials
• · Written notice of the assessment result and, if re-assessment was sought, the application and final conclusion

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)

The legal instrument must at minimum address: the purpose, method and scope of the transfer and the recipient’s use and method of processing; where and for how long the data is stored abroad, and how it is handled once the retention period ends, the agreed purpose is achieved or the instrument terminates; binding restrictions on onward transfers by the recipient; the security measures to be taken if the recipient’s actual control or business scope materially changes, if the data-security laws or cybersecurity environment of its jurisdiction change, or if another force majeure makes security hard to assure; remedies, liability for breach and dispute resolution; and the emergency-response requirements and the routes by which individuals can protect their rights if the data is tampered with, destroyed, leaked, lost, transferred or unlawfully acquired or used.

Applies when

Companies signing data-transfer agreements with an offshore parent, affiliate, cloud provider or model vendor. These six points are where assessments most often find gaps and should be mapped clause by clause.

Evidence to retain

• · Executed legal instrument with the offshore recipient, in a bilingual version
• · Mapping table from the six mandatory matters to the specific clause numbers
• · Onward-transfer approval process and the list of approved onward recipients
• · Monitoring and trigger-response records for changes in the recipient’s control or legal environment

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

An approval is valid for three years (Art. 9 of the Cross-border Data Flow Provisions supersedes the original two-year period). To continue transferring after expiry without a re-application trigger, apply through the provincial authority within 60 working days before expiry; once approved the validity extends by a further three years. Re-application is required during the validity period where the purpose, method, scope or categories of the transfer, or the recipient’s use or method, change in a way that affects security, or the offshore retention period is extended; where the data-security laws or cybersecurity environment of the recipient’s jurisdiction change, force majeure occurs, actual control of either party changes, or the legal instrument is amended in a way that affects security; or in any other circumstance affecting the security of the transfer.

Applies when

Companies that already hold an approval. The triggers most often missed in practice are switching offshore cloud regions or model vendors, adding new transferred data fields, and a group restructuring that changes control of the recipient.

Deadline: Three-year validity; an extension must be sought within 60 working days before expiry.

Evidence to retain

• · Register of approvals and validity periods, with expiry reminders configured
• · Extension application materials and the approval document
• · Change log for transfer parameters (fields, recipients, regions, purposes)
• · Records of re-application trigger assessments and the conclusions reached

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)