Measures on the Standard Contract for Outbound Transfer of Personal Information

Before settling on the standard-contract route, confirm in writing that all four conditions in Art. 4 are met: not a CIIO; processing the personal information of fewer than 1 million individuals; cumulative outbound transfers of fewer than 100,000 individuals’ personal information; and cumulative outbound transfers of fewer than 10,000 individuals’ sensitive personal information. Failing any one of them forces the security-assessment route, and retrofitting is expensive. Volumes are counted cumulatively from 1 January of the current year under Arts. 7 and 8 of CAC Order No. 16, which supersede the “since 1 January of the preceding year” wording in Art. 4 of these Measures. Separately confirm that the export contains no important data: important data must go through the security assessment (Art. 37 of the Network Data Security Management Regulations). That is not one of the four Art. 4 conditions, but it must be ruled out before the route is chosen.

Applies when

Every processor intending to use the standard contract for an outbound transfer of personal information.

Evidence to retain

• · Route-selection memo setting out the conclusion and basis for each of the four Art. 4 conditions
• · Statement on CIIO status, recording whether a designation notice was received
• · Counts of individuals processed and cumulatively transferred, with the counting methodology
• · Important-data determination showing the export contains no important data

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)

Before the transfer, run a personal information protection impact assessment focused on the matters enumerated in Art. 5 of the Measures, produced together with the assessment required by PIPL Arts. 55–56. The report is filed alongside the standard contract and is the principal document examined in any subsequent supervisory check.

Applies when

Every company using the standard-contract route. The assessment must address the data-protection legal environment of the recipient’s jurisdiction, which is the section most often written too thinly.

Evidence to retain

• · Outbound transfer impact assessment report including an analysis of the recipient jurisdiction’s legal environment
• · Field-level inventory of the personal information transferred, with a minimisation and necessity justification
• · Due-diligence pack on the recipient’s security capability
• · Risk-mitigation measures arising from the assessment, with evidence of implementation

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)

Art. 6 §1 requires the standard contract to be executed strictly in the form annexed to the Measures; §2 allows the parties to add other terms provided they do not conflict with the standard clauses; and §3 provides that the outbound transfer may only begin once the standard contract has taken effect. The CAC may adjust the annex, so confirm you are using the current version before signing. Note the sequencing in §3: sign, let the contract take effect, then transfer, then file within ten working days — the contract cannot be papered over while data is already moving.

Applies when

The Chinese processor entering into the agreement. Offshore recipients frequently propose substituting their own DPA or the EU SCCs, which is not accepted under PRC law.

Evidence to retain

• · Executed standard contract including the signature pages and annexes
• · Note on the provenance of the template version used and the version check performed
• · Schedule of supplementary terms and a legal opinion that they do not conflict with the standard clauses
• · Evidence of the offshore recipient’s internal signing authority

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

File with the provincial cyberspace authority within ten working days of the standard contract taking effect, submitting the contract and the impact assessment report among other materials. Where any circumstance listed in Art. 8 arises during the term, re-run the impact assessment, supplement or re-execute the standard contract, and complete the corresponding filing.

Applies when

Every company that has executed a standard contract. The most common re-filing triggers in practice are adding a transfer purpose or data category, changing the offshore recipient, and a change in the legal environment of the recipient’s jurisdiction.

Deadline: Filing within ten working days of the standard contract taking effect.

Evidence to retain

• · Filing receipt or system submission record from the provincial authority, with the submission timestamp
• · Archived filing pack (standard contract plus impact assessment report)
• · Timeline record comparing the contract effective date with the filing date to evidence the ten-working-day window
• · Trigger determinations and execution records for re-assessment and re-filing

Estimated first-time effort: 3–10 person-days (estimate, not a commitment)