Glossary

CAC (Cyberspace Administration of China / 国家网信办)

Definition

The Cyberspace Administration of China (CAC) is China's national cyberspace regulator. The institution's official Chinese portal at cac.gov.cn self-identifies under two names: 中央网络安全和信息化委员会办公室 (Central Cyberspace Affairs Commission Office) and 中华人民共和国国家互联网信息办公室 (Cyberspace Administration of the People's Republic of China). The official Chinese short form is 国家网信办; 网信办 is the colloquial short form. "CAC" is the standard English abbreviation for the same institution.

The English-language portal at cyberspace.gov.cn was unreachable at access time. "Cyberspace Administration of China" is the standard English rendering used across regulatory commentary and by the institution's own English-language materials. It is not a quoted English self-designation from a live CAC English portal.

On this site's beat, the CAC — authorized by the State Council to manage internet information content nationwide and to conduct supervision and enforcement — issues the regulatory instruments that govern data leaving China; for news-category Mini Program filings, the approving authority is the cyberspace administration at provincial level or above. The three CAC orders banked on this site — Order No.11, Order No.13, and Order No.16 — set the security-assessment procedure, the SCC filing mechanism, and the current threshold and exemption rules for cross-border data transfer.

One instrument pins down where that mandate comes from. State Council notice 国发〔2014〕33号 — full title 国务院关于授权国家互联网信息办公室负责互联网信息内容管理工作的通知, English rendering this site's own — authorizes the reorganized 国家互联网信息办公室 to manage internet information content nationwide and to conduct supervision and enforcement. The authorization defines what the CAC may do; the three orders define how data may leave China. Founding history, leadership, and organizational structure remain outside this page's claims.

Sources: CAC portal, www.cac.gov.cn; State Council notice 国发〔2014〕33号, www.gov.cn/zhengce/zhengceku/2014-08/28/content_9056.htm — both accessed 2026-10-02.

What the CAC does on this site's beat

The CAC's role on the questions this site covers reduces to two surfaces, both already cited on existing pages.

The three data-export orders

The CAC issued the three regulations that define how personal information may leave mainland China. Each one is cited on the cross-border data transfer page with its official gov.cn text.

• Order No.11 (数据出境安全评估办法, Security Assessment Measures for Data Export) — effective 2022-09-01. Establishes the security assessment procedure. The national cyberspace department conducts the assessment; the provincial cyberspace department receives and checks filing materials. www.gov.cn/zhengce/zhengceku/2022-07/08/content_5699851.htm
• Order No.13 (个人信息出境标准合同办法, Standard Contract Measures for Personal Information Export) — effective 2023-06-01. Establishes the standard contractual clause (SCC) filing mechanism. The processor signs the CAC-issued template contract with the overseas recipient and files it with the provincial cyberspace department within 10 working days. www.gov.cn/gongbao/content/2023/content_5752224.htm
• Order No.16 (促进和规范数据跨境流动规定, Provisions on Promoting and Regulating Cross-Border Data Flows) — effective 2024-03-22. Restates the threshold ladder, introduces exemption tiers, and supersedes the earlier orders where inconsistent. www.gov.cn/gongbao/2024/issue_11366/202405/content_6954192.html

The on-site citations label all three instruments CAC orders (Order No.11, No.13, No.16). The orders' own wording refers to the national cyberspace department and the provincial cyberspace department; this site cites that wording without asserting how those bodies map onto the CAC's organizational structure.

News pre-approval for Mini Program categories

Mini Programs that fall under the "News" category require pre-approval from the cyberspace administration at provincial level or above before the ICP filing can proceed. The required document is an Internet News Information Service License. Without it, the filing is rejected.

Standard retail, D2C, and lifestyle Mini Programs rarely trigger this pre-approval requirement.

Where the CAC sits vs the other regulators

This site uses a four-domain framing for the regulators that touch a mainland China digital entry: "MIIT notices, CAC orders, a SAFE measure, WeChat platform gates" (regulations timeline).

Within that framing:

• MIIT — ICP filing and license; APP filing
• PSB — police-side registration after the ICP filing issues
• SAFE — cross-border settlement and foreign exchange
• CAC — data-export instruments (Orders No.11, No.13, No.16) and news pre-approval for Mini Program categories

The CAC does not issue ICP filings. The CAC does not handle police registration. The CAC does not regulate cross-border payment settlement. Each regulator on this list owns its own lane.

What this page deliberately does not cover

This page is definitional. It identifies the CAC, cites the State Council notice that authorizes it, and names the instruments it issued that this site cites. It does not cover:

• The cross-border transfer mechanisms themselves. The threshold ladder, the exemption tiers, the SCC filing procedure, and the security assessment timeline belong on the cross-border data transfer page. That page owns the mechanisms; this page names the authority behind them.
• PIPL mechanics. The Personal Information Protection Law's full scope, Article 3 extraterritorial reach, Article 39 separate-consent requirement, and processing obligations belong on the PIPL page. For the operational layer — what those obligations require of a foreign company in practice — see our PIPL compliance for foreign companies article.
• Data residency and storage localization. The question of where mainland-collected personal information must be stored belongs on the data residency page.
• The CAC's founding history, leadership, or organizational structure. No primary source accessible from this site supports those claims at a precision level we would stand behind. The 2014 State Council authorization is now banked above; the CAC's enforcement record and statistics are not.
• A general division of labor among Chinese regulators. The four-domain framing above is the extent of what this site claims. Any broader taxonomy would go beyond banked facts.

Frequently asked questions

Related terms

• Cross-Border Data Transfer (China) — the three Article 38 mechanisms and the 2024 exemption tiers; the page that owns the transfer-mechanism detail.
• PIPL (个人信息保护法) — the statute behind the data-export regime; Article 38 transfer bases, Article 39 separate consent, Article 3 offshore reach.
• Data Residency in China — the storage-side localization obligation under PIPL Article 40; the complement to the transfer-mechanism question.
• PSB Filing (公安备案) — the police-side registration that follows the ICP filing; a separate authority from the CAC.

Related reading

• PIPL Compliance for Foreign Companies — the statute behind the data-export regime the CAC instruments operationalize, walked through as obligations a company implements.
• ICP Compliance Service — the entity and filing foundation that every CAC-gated surface (site, app, Mini Program) sits on.
• WeChat Ecosystem Service — Mini Program and WeChat Pay builds that meet the filing and pre-approval gates this page names.
• 10-Point China Readiness Diagnostic — score your site's readiness before planning around any of the instruments on this page.
• China Digital Entry Glossary — the full term set in one place.

Source notes

No claims from memory, no third-party summaries. The portal claim and the State Council authorization notice below are our own fetches; the three order citations mirror the gov.cn texts already banked in the source registry. Government URLs on this page stay as plain-text references; the source registry hyperlinks every live-tagged primary.

1. Portal self-identification (中央网络安全和信息化委员会办公室 / 中华人民共和国国家互联网信息办公室) — www.cac.gov.cn, accessed 2026-10-02.
2. 数据出境安全评估办法 (Order No.11), effective 2022-09-01 — www.gov.cn/zhengce/zhengceku/2022-07/08/content_5699851.htm, accessed 2026-10-02.
3. 个人信息出境标准合同办法 (Order No.13), effective 2023-06-01 — www.gov.cn/gongbao/content/2023/content_5752224.htm, accessed 2026-10-02.
4. 促进和规范数据跨境流动规定 (Order No.16), effective 2024-03-22 — www.gov.cn/gongbao/2024/issue_11366/202405/content_6954192.html, accessed 2026-10-02.
5. 国务院关于授权国家互联网信息办公室负责互联网信息内容管理工作的通知 (国发〔2014〕33号), published 2014-08-28 — www.gov.cn/zhengce/zhengceku/2014-08/28/content_9056.htm, accessed 2026-10-02.
6. On-site facts drawn from existing chinagateway.pro content: the regulations timeline four-domain line, the Mini Program ICP filing pre-approval table, and the cross-border data transfer order citations.

This page deliberately excludes any claim not traceable to the sources above: founding history, leadership, organizational structure, enforcement statistics, and any English self-designation quoted from a live CAC English portal (cyberspace.gov.cn was unreachable at access time). The one enforcement-related claim the page makes — the 2014 State Council authorization — is cited to 国发〔2014〕33号 above.