Measures on Certification for Outbound Transfer of Personal Information

After confirming eligibility under Art. 5, define precisely the scope submitted for certification: the business scenarios covered, the data categories and fields, the onshore and offshore entities, the direction and frequency of transfers, and the recipient jurisdictions. The certified scope then becomes the compliance boundary — Art. 10 requires the certification body to suspend and ultimately revoke the certificate where actual transfers depart from it — so the scope must be neither so narrow that it constrains the business nor so broad that it cannot be evidenced.

Applies when

Non-CIIO processors choosing the certification route, especially groups with multi-entity transfer architectures.

Evidence to retain

• · Scope statement covering business scenarios, data fields, entities, flows and jurisdictions
• · Eligibility determination record (non-CIIO status, volume thresholds, absence of important data)
• · Intra-group data flow map and entity relationship diagram
• · Documented change-control process for scope changes

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Before applying for certification of an outbound transfer, perform the statutory duties of notice, obtaining separate consent, and running a personal information protection impact assessment. Art. 6 sets out what the assessment must focus on, and it dovetails with the separate consent for outbound transfers in PIPL Art. 39 and the assessment requirements in PIPL Arts. 55–56. The certification body takes this pack as its input for the conformity assessment, and an incomplete pack is a direct cause of failure.

Applies when

Every processor applying for outbound transfer certification.

Evidence to retain

• · Text of the outbound-transfer notice and screenshots of where it is displayed, covering the recipient’s name and contact details, the purposes and methods, the data categories and how rights are exercised
• · Captured interaction evidence and consent logs for the separate outbound consent
• · Personal information protection impact assessment report organised around the matters in Art. 6
• · Remediation items arising from the assessment, with closure evidence

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

Apply to a body holding accreditation for personal information protection certification, which carries out the assessment under the basic certification specification and the certification rules and issues a certificate where the requirements are met. Within five working days of issuing a certificate or of any change in its status, the body must report the certificate number, the certified processor’s name, the certified scope and the status change to the national certification and accreditation information platform, so certificate status is publicly checkable. After certification the processor must keep actual transfers within the certified scope and submit to supervision, spot checks and evaluation by SAMR and the CAC.

Applies when

Companies choosing the certification route. Because certificate status is publicly checkable, offshore customers and investors can verify it directly — an asset commercially, but also a risk, since a suspension becomes visible immediately.

Deadline: The body must report to the platform within five working days of issuing a certificate or of a status change, and must file with the CAC within ten working days of obtaining accreditation.

Evidence to retain

• · Verification record for the certification body’s accreditation, including its CAC filing
• · Certification application pack and the certificate issued by the body
• · Screenshot of the certificate record published on the national certification and accreditation information platform
• · Periodic reconciliation records comparing actual transfers against the certified scope
• · Records of responses to supervision, spot checks and evaluation, with remediation closure evidence

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)