Outbound Data Transfer Risk Self-Assessment Report (per the CAC filing guide template)

Structure (10 sections)

1. 1. Front matter 1. Threshold triage: which route does this flow take (guide, "Scope")

   Decide whether a security assessment filing is actually required before writing the report. **Test the thresholds against the Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16, published and in force 22 March 2024), not against the older thresholds recited in the "Scope" section of the 2022 first edition of the filing guide** — Art. 13 of Order No. 16 states expressly that where Order No. 11 and related rules are inconsistent with it, Order No. 16 prevails. The current filing thresholds are the two limbs of Art. 7: (1) a critical information infrastructure operator providing personal information or important data abroad; and (2) any other processor providing important data abroad, or providing abroad, **cumulatively since 1 January of the current year**, the personal information of more than one million people (excluding sensitive personal information) or the sensitive personal information of more than ten thousand people. Art. 8: a non-CIIO processor that has, cumulatively since 1 January of the current year, provided abroad the personal information of at least one hundred thousand but fewer than one million people (excluding sensitive personal information), or the sensitive personal information of fewer than ten thousand people, must instead conclude a standard contract or obtain personal information protection certification. Arts. 3 to 6 carry exemptions (data from international trade and similar activities containing neither personal information nor important data; personal information collected abroad, processed in China and sent back out without introducing domestic personal information or important data; contracts to which the individual is a party; cross-border human-resources management; emergencies; a non-CIIO processor providing fewer than one hundred thousand people’s personal information excluding sensitive personal information since 1 January of the current year; and data outside a free trade zone negative list). Note Art. 2 as well: data not notified or publicly announced as important data by the relevant authority or region need not be filed as important data. Note also that the guide defines outbound data transfer to include two things: transmitting or storing abroad data collected or generated in domestic operations; and data stored domestically that entities, organisations or individuals abroad can query, retrieve, download or export. The second limb is the one most often missed — an overseas team reaching a domestic database through a jump host is an outbound transfer too. Flows below the threshold move to the standard-contract filing or the personal information protection certification route; where an exemption under the Provisions on Promoting and Regulating Cross-Border Data Flows is relied on, keep a written, checkable basis. The output is a flow-to-route mapping table, with the cumulative counting start date and methodology stated.

   Evidence to attach

   • · Flow-to-route mapping (filing / standard-contract filing / certification / exemption for each flow)
   • · Cumulative headcount methodology and records (start date, deduplication convention, source systems)
   • · Statement on critical information infrastructure status and which authority so notified the company
   • · Important-data determination and its basis (whether notified by an authority or matched to a published catalogue)
   • · Inventory of remote-access flows where data stays in China but can be queried or retrieved from abroad
   • · Written basis and internal approval for any exemption relied on

   Common pitfalls

   • · Counting only pushed transfers and omitting remote query, retrieval and export flows, which badly understates the cumulative headcount;
   • · Still testing against the superseded Order No. 11 Art. 4 thresholds (one million / one hundred thousand / ten thousand, counted "from 1 January of the preceding year") when Order No. 16 Arts. 7 and 8 changed the clock to 1 January of the current year and rebanded the numbers;
   • · Treating intra-group transfers as internal movement rather than outbound transfer;
   • · Relying on an exemption with no written basis, leaving nothing to show at inspection;
   • · Asserting "no important data involved" with no record of an identification exercise.

2. 2. Front matter 2. Cover page and the four declarations (guide Annex 4, "Notes")

   Before the body, the Annex 4 template calls for the processor’s name with its company seal and the date, plus four declarations: that a self-assessment report must be provided when filing; that the processor is responsible for the authenticity of the report and its attachments; that the self-assessment described was completed within the three months preceding this filing; and that where a third-party institution took part, the report must describe that institution and its involvement, with the company seal applied to the relevant pages. The three-month window is a hard constraint and mirrors the fourth undertaking in the application form (that the self-assessment was completed within three months before the filing date and that no material change has occurred since), so treat the gap between completing the self-assessment and submitting the pack as a controlled variable rather than letting document preparation stretch. Where a third-party institution is engaged, state its name, credentials, the scope of its involvement (which chapters it performed) and the boundary of its responsibility.

   Evidence to attach

   • · Sealed cover page with the date
   • · Record of the interval between completing the self-assessment and submitting the filing, proving it is within three months
   • · The third-party institution’s credentials, engagement contract and scope of involvement
   • · Internal sign-off on authenticity by the data-security officer and legal representative

   Common pitfalls

   • · A self-assessment completed six months earlier, with document preparation pushing submission past the three-month window and forcing a redo;
   • · A third-party institution doing most of the work without being described in the report, which reads as concealment when queried;
   • · The seal applied only to the cover and not to the pages covering third-party involvement;
   • · Filing on the original report after a material change (a new flow, a changed recipient) since the self-assessment.

3. 3. 1. Summary of the self-assessment work (Annex 4, Chapter 1)

   Annex 4 Chapter 1 asks how the self-assessment was carried out, including start and end dates, how it was organised, how it was executed and by what methods. Write it as a checkable project record rather than boilerplate: dates to the day; organisation naming the lead department, the participating departments (legal, security, business, IT, HR), the members of the assessment team and their roles, and how the data-security officer and the data-security management body took part; execution by phase (scoping → asset and flow inventory → interviews and evidence collection → risk analysis → remediation → review → conclusion), each with dates and deliverables; and methods used (document review, system inspection, staff interviews, technical testing, sampled verification) with the coverage and sampling rate of each. Where a third party took part, expand here on what the cover declaration promised. Reviewers look for two things in this chapter: that the assessment genuinely happened rather than being written up after the fact, and that the team spanned business, technical and legal competence.

   Evidence to attach

   • · Assessment work plan and kick-off minutes
   • · Assessment team list with role assignments, including external experts
   • · Interview records signed by the interviewees
   • · Raw records of system inspection and technical testing
   • · Sampling plan and coverage rate
   • · List of phase deliverables with timestamps

   Common pitfalls

   • · A three-line chapter that shows no real effort;
   • · An all-legal assessment team with no engineers, which hollows out the technical half of the risk analysis;
   • · Dates that do not reconcile with those on interview records and test reports;
   • · Methods listed as document review only, with no system inspection or technical testing.

4. 4. 2. Overall picture (part 1): the processor, the business and the systems (Annex 4, Ch. 2(1)–(2))

   Annex 4 Chapter 2(1) asks for the processor’s basic information: basic details of the organisation or individual; equity structure and ultimate controller; organisational structure; the data-security management body; the overall business and data picture; and domestic and overseas investments. Chapter 2(2) asks about the business and information systems involved in the transfer: the basic profile of the business; its data assets; its information systems; the data centres involved, including cloud services; and the transfer links. Equity structure, ultimate controller and overseas investment are especially sensitive for AI companies: where there are offshore investors, a VIE structure or overseas affiliates, disclose them proactively and accurately and explain their bearing on data access and the isolating measures taken — evasion lengthens the review rather than shortening it. Write the systems part so it reconciles with item 08 of the application form, "transfer links": the link provider, the number of links and their bandwidth, the names and physical locations of the landing data centres inside and outside China, and IP addresses.

   Evidence to attach

   • · Business licence, unified social credit code certificate and articles of association
   • · Equity chart and ultimate-controller statement, looking through offshore shareholders
   • · Organisation chart, the establishing document for the data-security body and its headcount
   • · Business and data-asset inventory with classification and grading results
   • · System inventory and network topology
   • · Data-centre and cloud contracts with evidence of physical location
   • · Technical description of the transfer links (provider, bandwidth, IP ranges)

   Common pitfalls

   • · An equity chart that stops at direct shareholders without looking through to the ultimate controller, which reads as concealing offshore capital;
   • · A data-security management body that exists only on paper, with no headcount and no meeting records;
   • · A data-asset inventory with no classification or grading, leaving the later "data to be transferred" chapter with nothing to build on;
   • · Link descriptions that do not match item 08 of the application form;
   • · Cloud data-centre locations taken from sales material rather than verified.

5. 5. 3. Overall picture (part 2): the data and the security capability (Annex 4, Ch. 2(3)–(4))

   Chapter 2(3), the data to be transferred, asks for: the purpose, scope and method of the transfer and of the recipient’s processing, and their lawfulness, legitimacy and necessity; the volume, scope, categories and sensitivity of the data; the platforms and data centres where the data is stored in China and where it is planned to be stored after transfer; and any provision onward to other overseas recipients. Sensitivity of personal information may be judged by reference to the national standard on personal information security specification. Chapter 2(4), the processor’s data-security capability, asks for four things: management capability, covering the management organisation and the policy framework, and the implementation of lifecycle management, classification and grading, emergency response, risk assessment and protection of personal information rights; technical capability, covering the security measures applied across collection, storage, use, processing, transmission, provision, publication and deletion; evidence that the safeguards work, such as data-security risk assessments, data-security capability certification, security inspections and testing, compliance audits and cybersecurity multi-level protection scheme testing; and the record of compliance with data and network security laws. That evidence requirement is the watershed for this chapter: naming policies without a test report, audit conclusion or certificate will draw a request for supplementary materials.

   Evidence to attach

   • · Field-level inventory of the data to be transferred (category, volume, sensitivity tag, number of individuals)
   • · Minimisation and necessity analysis: why each field must leave, and whether masking or aggregation would do
   • · Storage-location table before and after transfer
   • · Description of onward provision and the contractual restrictions on it
   • · Compiled data-security policies and evidence they run (training, drills, approval trails)
   • · Multi-level protection scheme test report and filing certificate
   • · Compliance audit reports, capability certificates and risk assessment reports
   • · The personal information protection impact assessment (see the PIPIA template)

   Common pitfalls

   • · A necessity argument that argues business importance instead of answering whether fewer fields would do;
   • · A capability chapter that lists policy titles with no effectiveness evidence at all;
   • · Multi-level protection testing not done or expired, when the transferring system is exactly what should be graded;
   • · Sensitivity judgements with no basis and no reference to the national standard;
   • · Stating "no onward provision" while the contract does not actually prohibit the recipient from sub-contracting.

6. 6. 4. Overall picture (part 3): the recipient and the legal instrument (Annex 4, Ch. 2(5)–(7))

   Chapter 2(5), the overseas recipient, asks for: its basic details; the purpose and method of its processing; its data-security capability; the network and data security laws of its country or region; and a lifecycle description of its processing. Chapter 2(6), the allocation of data-security responsibilities in the legal instrument, must track the six matters Art. 9 of the Measures requires the instrument to stipulate expressly: the purpose, method and scope of the transfer and the recipient’s purpose and method of processing; the location and period of overseas storage and what happens to the data when the period expires, the agreed purpose is achieved or the instrument terminates; binding requirements on onward transfer by the recipient to other organisations or individuals; the security measures to be taken where the recipient’s actual control or scope of business changes materially, where the data-security policy or cybersecurity environment of its country or region changes, or where force majeure makes data security hard to assure; remedial measures, liability and dispute resolution for breach of the agreed duties; and requirements for proper emergency response where the transferred data is tampered with, destroyed, leaked, lost, transferred or unlawfully obtained or used, together with the channels and methods by which individuals can protect their personal-information rights. Item 13 of the application form further requires the page number and clause number of each of these six matters in the instrument, with the clauses highlighted or boxed; the Chinese version of the instrument governs, and where only a non-Chinese version exists an accurate Chinese translation must be submitted alongside. Chapter 2(7) is for anything else the processor considers worth explaining.

   Evidence to attach

   • · The recipient’s corporate registration, equity structure and ultimate controller
   • · Evidence of the recipient’s security capability (certificates, audit reports, questionnaire responses)
   • · Analysis of the network and data security laws of the recipient’s country or region, including the government-access framework
   • · Lifecycle process map of the recipient’s processing
   • · The executed or draft legal instrument in Chinese, with an accurate Chinese translation if the original is in another language
   • · A page-and-clause cross-reference table for the six mandatory matters, plus the highlighted copy
   • · Due-diligence results on the recipient’s past data-security incidents

   Common pitfalls

   • · The fourth mandatory matter — change of control, change in the destination country’s legal environment, force majeure — has no counterpart in most foreign-standard contracts, so lifting one wholesale leaves a gap;
   • · Submitting only the English contract without an accurate Chinese translation;
   • · Not marking page and clause numbers per item 13 and not highlighting them, leaving the reviewer to hunt;
   • · A destination-law analysis that says only "the country has a comprehensive data protection law" and never addresses government access;
   • · Recipient security capability resting entirely on self-declaration with no third-party evidence.

7. 7. 5. Risk assessment of the intended transfer (Annex 4, Ch. 3; the six matters in Art. 5)

   Annex 4 Chapter 3 requires the risk assessment to address each of the following, focusing on the problems and latent risks found and the remediation taken and its effect: the lawfulness, legitimacy and necessity of the purpose, scope and method of the transfer and of the recipient’s processing; the volume, scope, categories and sensitivity of the data and the risks the transfer may pose to national security, the public interest and the lawful rights of individuals or organisations; whether the responsibilities the recipient undertakes, and its management and technical measures and capability to discharge them, can secure the data; the risk of the data being tampered with, destroyed, leaked, lost, transferred or unlawfully obtained or used during and after the transfer, and whether individuals have a workable channel to protect their rights; whether the contract or other legally binding instrument to be concluded adequately allocates data-security responsibilities; and any other matter bearing on the security of the transfer. The most common failure here is claiming there are no risks: the template expressly asks you to focus on the problems and latent risks found, so a report with no findings and no remediation is itself a signal of inadequacy. Write each item in five parts — problem found → risk impact → remediation → completion and verification evidence → residual risk — and allow a small number of accepted residual risks with an explanation of why they are acceptable.

   Evidence to attach

   • · Item-by-item analysis of the six matters, covering findings, remediation, verification and residual risk
   • · Remediation register (owner, deadline, completion evidence, verification record)
   • · Dedicated analysis of national-security and public-interest impact, mandatory where important data is involved
   • · Usability testing of the rights-protection channel for individuals (response time, reachability)
   • · Clause-by-clause adequacy conclusions on the contract
   • · Residual-risk acceptance record with signatory and reasons

   Common pitfalls

   • · All six items reading "no risk found", when the template expressly asks you to focus on problems — an issue-free report is itself not credible;
   • · Remediation described as a plan, with no completion evidence or verification;
   • · A rights-protection channel described as "contactable by email" with no test of reachability or response time;
   • · The national-security and public-interest item left blank or marked "not applicable" with no reasoning;
   • · Risk analysis disconnected from the facts in Chapter 2, so the conclusions have no visible derivation.

8. 8. 6. Self-assessment conclusion (Annex 4, Chapter 4)

   Annex 4 Chapter 4 requires an objective self-assessment conclusion on the intended transfer, drawing together the risk assessment and the remediation, and fully explaining the reasons and evidence behind it. "Objective" and "fully explain the reasons and evidence" are the operative words: the conclusion cannot be a single line saying risk is controllable and the transfer may proceed, but must restate the key facts and the chain of reasoning — which risks have been reduced to an acceptable level by remediation, which residual risks are accepted and why, and on what premises the conclusion holds (the scope of transferred data does not widen, the recipient does not change, the destination country’s legal environment does not change materially). State the boundary of the conclusion too: which flows, which data categories and which time period it covers. Have the data-security officer and the legal representative sign it, and keep it consistent with the undertaking in the application form that the self-assessment was completed within the three months before filing and that nothing material has changed since.

   Evidence to attach

   • · The reasoning chain behind the conclusion (key facts → analysis → conclusion)
   • · Statement of the conclusion’s boundary (flows, data categories, period, premises)
   • · Signature page for the data-security officer and legal representative
   • · Consistency check against the undertakings in the application form
   • · What happens if a premise of the conclusion ceases to hold

   Common pitfalls

   • · A one-line conclusion with no reasoning connecting it to the findings in Chapter 3;
   • · No premises stated, so after a business change nobody can tell whether the conclusion still holds;
   • · Signed only by the authorised handler, without the legal representative;
   • · A conclusion inconsistent with the undertakings in the application form, such as mismatched self-assessment dates.

9. 9. 7. Application pack and filing process (guide, "Filing method and process" and "Materials")

   The self-assessment report is only one item in the pack. The guide lists the materials to submit: a copy of the unified social credit code certificate; a copy of the legal representative’s identity document; a copy of the authorised handler’s identity document; the power of attorney for the handler (Annex 2 template); the application form (Annex 3 template, comprising an undertaking and the application table); a copy of the contract or other legally binding instrument to be concluded with the overseas recipient; the risk self-assessment report (Annex 4 template); and other supporting materials. Annex 1 also sets the form of each item (copies bearing the company seal, or originals) and requires the electronic versions to be submitted on optical disc alongside the paper pack. On process: the processor files through its provincial cyberspace authority by delivering the paper pack with electronic copies; the provincial authority completes a completeness check within five working days and either escalates the pack to the national authority or returns it; the national authority decides whether to accept within seven working days of receiving the escalated pack and notifies the processor in writing; where asked to supplement or correct materials the processor must do so promptly, and the assessment will be terminated if it fails to without good reason; in complex cases the processor is told how long the assessment is expected to be extended; once the assessment concludes the processor receives a result notice, and may apply to the national authority for re-assessment within fifteen working days of receiving it, the re-assessment result being final. The processor is responsible for the authenticity of what it submits; submitting false materials is treated as failing the assessment and carries legal liability. The list and the timings above are taken verbatim from the first edition of the guide. The five working days for the provincial completeness check and the forty-five working days from the acceptance notice also rest on Arts. 7 and 12 of the Measures, which are departmental rules; but the "seven working days for the national authority to decide on acceptance" appears only in the guide and can move with a new edition, so confirm it with your provincial authority before building a schedule around it.

   Evidence to attach

   • · Checklist of materials against their form requirements (sealed copy / original / electronic)
   • · Power of attorney on the Annex 2 template, with the authorisation period and no power to sub-delegate
   • · The undertaking signed by the legal representative and sealed, plus the application table
   • · The highlighted contract with the page-and-clause cross-reference for the six matters
   • · Delivery receipt from the provincial authority and the completeness-check outcome
   • · The national authority’s acceptance notice and any supplementation records
   • · The assessment result notice and, where used, the re-assessment application

   Common pitfalls

   • · Materials in the wrong form (unsealed where a seal is required, a copy where an original is required), which fails the completeness check;
   • · A power of attorney with no authorisation period, or a handler who has since left;
   • · Preparing only the paper pack and being asked on the day for the electronic version;
   • · Missing a supplementation deadline, which terminates the assessment and forces a restart;
   • · Reading the five and seven working days as the total assessment duration, and badly under-budgeting the schedule.

10. 10. 8. Validity, extension and re-filing triggers

    Passing the assessment is not the end. Cover three things here. First, validity and extension: record the start and end of the validity period in the result notice, the internal reminder point (leave enough time before expiry to run a fresh self-assessment and filing), and the route and materials for an extension application. Second, re-filing triggers: turn the situations under the Measures and the Provisions on Promoting and Regulating Cross-Border Data Flows that would undo the original conclusion into a monitorable list — changes in the purpose, method, scope, categories or sensitivity of the data transferred; an extended overseas retention period; changes in the data-security policy or cybersecurity environment of the recipient’s country or region; a change in the recipient’s actual control; amendments to the legal instrument; and any other situation affecting the security of the transferred data. Assign an owner and a monitoring method to each (contract-change review, business-requirement review, regulatory monitoring, annual vendor re-assessment). Third, keep the transfer register current: a change history of flows, volumes, recipients and instrument versions, so the next self-assessment builds on the register incrementally instead of starting from nothing.

    Evidence to attach

    • · The result notice and a validity register, including the internal reminder
    • · Re-filing trigger list with owners
    • · Change history of the transfer register (flows, volumes, recipients, instrument versions)
    • · Extension application materials and records, where an extension was sought
    • · Internal review records and decisions when a trigger fires

    Common pitfalls

    • · Treating expiry as a reminder rather than a project and starting two weeks out, too late to complete a fresh self-assessment;
    • · The business adding fields or recipients without review, which quietly invalidates the original conclusion;
    • · A recipient being acquired or changing control without anyone noticing;
    • · An unmaintained register, so the next self-assessment starts from scratch, raising both cost and error rate.