China Data Protection Landscape and Cross-Border Considerations
The cross-border regime
PIPL Article 38 allows transfers only through one of: CAC security assessment; certification by a professional institution; a CAC standard contract; or another legal route. Article 39 adds separate consent and disclosure of the overseas recipient’s identity, contact, purposes, method, categories, and rights exercise. Article 40 requires CIIOs and processors above CAC’s volume threshold to store PI domestically; export requires security assessment. Article 41 blocks providing data to foreign judicial or law-enforcement authorities without Chinese approval.
Thresholds and routes
Security assessment is required for: important data; CIIOs exporting PI or important data; cumulative export of PI of more than 1 million individuals since January 1; or sensitive PI of more than 10,000 individuals since January 1. For non-CIIOs without important data, 2024 CAC provisions exempt exports of fewer than 100,000 individuals’ non-sensitive PI, and provide narrow exemptions for certain HR, trade, academic, and emergency scenarios. Exports of 100,000 to 1 million non-sensitive PI, or fewer than 10,000 sensitive PI, may use the standard contract or certification. The standard contract must follow the CAC template and be filed with the provincial CAC within 10 working days of effectiveness.
Worked example
A Chinese SaaS company with 500,000 users sends HR records to its global parent. It is not a CIIO and holds no important data. The export covers 500,000 non-sensitive records, so security assessment is not triggered (below 1 million), but the de minimis exemption does not apply (above 100,000). It may choose certification or the standard contract. If 12,000 records include health data, sensitive PI exceeds 10,000, so security assessment is required. In both cases: PIPIA, Article 39 separate consent, and recipient disclosure.
Traps
- Thinking consent alone authorizes a transfer.
- Confusing the standard contract with a contract signed by CAC; CAC files it, not a party.
- Treating PIPIA as the same as security assessment.
- Assuming “not CIIO” without checking sector designation.
- Missing that important data triggers assessment regardless of volume.