Glossary

Cross-Border Data Transfer in China

Definition

Cross-border data transfer in China is the provision of personal information collected inside the mainland to a recipient outside the mainland. The Personal Information Protection Law (PIPL) permits these transfers only after the processor satisfies one of three mechanisms Article 38 prescribes — or qualifies for an exemption under the 2024 Provisions on Promoting and Regulating Cross-Border Data Flows (Cyberspace Administration of China [CAC] Order No.16, effective 2024-03-22). Regulation titles and article glosses on this page are writer translations of the official Chinese texts published at gov.cn, not official translated quotes.

The three mechanisms are: a security assessment organized by the national cyberspace department, a standard contractual clause (SCC) filing with the provincial cyberspace department, or personal information protection certification by a professional institution. Which mechanism applies depends on the processor's classification, the data type, and the volume transferred since January 1 of the current calendar year.

This page defines each mechanism, the threshold ladder that determines which one applies, and the 2024 exemption tiers that remove the mechanism requirement for defined categories of transfers. For the handler-side duties that sit around these transfers — lawful bases, notices, and impact assessments — see PIPL compliance for foreign companies.

The three cross-border data transfer mechanisms

1. Security assessment (数据出境安全评估)

The security assessment is a government review conducted by the national cyberspace department. It applies to the highest-risk transfer categories.

Who must use it (post-2024, per Order No.16 Art.7):

• Critical information infrastructure operators (CIIOs) exporting personal information or important data.
• Non-CIIO processors exporting important data.
• Non-CIIO processors that have cumulatively transferred personal information of 1,000,000 or more individuals (non-sensitive) since January 1 of the current year.
• Non-CIIO processors that have cumulatively transferred sensitive personal information of 10,000 or more individuals since January 1 of the current year.

Procedure. The processor submits assessment materials — a filing application, a self-assessment report, and the legal documents with the overseas recipient — through the provincial cyberspace department to the national authority (Order No.11 Arts. 6–7). The provincial department checks completeness within 5 working days. The national cyberspace department decides whether to accept the filing within 7 working days of receiving the application materials (Order No.11 Art.7).

Decision timeline. 45 working days from the date the written acceptance notice is issued (Order No.11 Art.12). The processor may apply for re-evaluation within 15 working days of receiving the result; the re-evaluation result is final (Order No.11 Art.13).

Validity. 3 years from the date the assessment result is issued. The processor may apply within 60 working days before expiry to extend the result by another 3 years, subject to national cyberspace department approval (Order No.16 Art.9). This replaces the original 2-year validity in Order No.11 Art.14; Order No.16 Art.13 supersedes it where inconsistent.

Regulation. CAC Order No.11 (数据出境安全评估办法), effective 2022-09-01. Threshold provisions superseded by Order No.16 Art.7 where inconsistent (Order No.16 Art.13).

2. Standard contractual clause filing (个人信息出境标准合同)

The SCC is a model contract issued by the national cyberspace department. The processor signs it with the overseas recipient and files it with the provincial cyberspace department.

Who may use it (post-2024, per Order No.16 Art.8):

• Non-CIIO processors.
• Cumulative transfers since January 1 of the current year: 100,000 or more but fewer than 1,000,000 individuals' personal information (non-sensitive), or fewer than 10,000 individuals' sensitive personal information.

Procedure. The contract must follow the template attached to the SCC Measures exactly. The contract takes effect before any personal information leaves the mainland (Order No.13 Art.6). Within 10 working days of the contract's effective date, the processor files with its provincial cyberspace department. Filing materials are the signed contract and the personal information protection impact assessment report (Order No.13 Art.7).

Anti-circumvention. Processors may not split data volumes to avoid the security assessment threshold and route transfers through the SCC path instead (Order No.13 Art.4).

Regulation. CAC Order No.13 (个人信息出境标准合同办法), effective 2023-06-01. Eligibility thresholds superseded by Order No.16 Art.8 where inconsistent (Order No.16 Art.13).

Filing guides and submission platform. On 2024-03-22 CAC published second editions of both filing guides — 数据出境安全评估申报指南（第二版） (Security Assessment Application Guide) and 个人信息出境标准合同备案指南（第二版） (SCC Filing Guide) — which state the method, process, and required materials for each route, optimized and simplified against the first editions. CAC also operates the Data Export Application System (数据出境申报系统) at sjcj.cac.gov.cn, which accepts both security-assessment applications and SCC filings; a user manual is posted on the system homepage.

3. Personal information protection certification (个人信息保护认证)

Certification is the third Article 38 mechanism. A professional institution certifies the processor's cross-border transfer arrangements under rules the national cyberspace department issues.

Certification occupies the same eligibility band as the SCC: non-CIIO processors that have transferred non-sensitive personal information of 100,000 or more but fewer than 1,000,000 individuals, or sensitive personal information of fewer than 10,000 individuals, in the current calendar year (Order No.16 Art.8). The processor chooses one — the two are alternatives, not cumulative requirements.

Detailed certification procedures, accredited bodies, and scope rules are not published in the regulations we have verified for this page. The mechanism exists as a statutory option; processors should confirm current certification pathways with the national cyberspace department or an accredited body before relying on it.

The threshold ladder

The mechanism a processor must use depends on cumulative volumes since January 1 of the current calendar year. The ladder, as restated by Order No.16:

The top rung turns on CIIO designation — a regulator-notified status under the CII Security Protection Regulation, not a self-declaration.

The sensitive and non-sensitive tracks are separate. A processor that has transferred sensitive PI of 10,000 or more individuals triggers the security assessment regardless of where its non-sensitive volume falls. What "sensitive" means is defined by PIPL Article 28 — see the sensitive personal information definition for the statutory category set and the separate-consent condition.

The 2024 exemption regime (Order No.16)

Order No.16, effective 2024-03-22, introduced exemptions that remove the transfer mechanism requirement entirely for defined categories. Where Order No.16 is inconsistent with the earlier Orders No.11 and No.13, Order No.16 prevails (Art.13).

Tier 1 — Non-personal, non-important data (Art.3)

Data collected in international trade, cross-border transport, academic cooperation, transnational manufacturing, and marketing activities that does not contain personal information or important data is exempt from all three mechanisms. No filing, no contract, no certification.

Tier 2 — Foreign-collected PI re-exported (Art.4)

Personal information collected and generated outside the mainland, transmitted into the mainland for processing, and then sent back offshore — where the processing did not introduce mainland personal information or important data — is exempt from all three mechanisms.

Tier 3 — Necessity and category exemptions (Art.5, items 1–3)

1. Contract conclusion or performance — transfers necessary to conclude or perform a contract to which the individual is a party: cross-border shopping, courier delivery, remittance, payment, account opening, flight and hotel booking, visa processing, examination services.
2. Cross-border HR management — implemented under lawfully adopted labor rules and collective contracts concluded under the law.
3. Emergency protection — protecting a natural person's life, health, and property safety in an emergency.

None of the three carries a volume condition. None covers important data (Art.5, final paragraph).

Tier 4 — Volume-based exemption (Art.5, item 4)

Non-CIIO processors that have cumulatively transferred personal information of fewer than 100,000 individuals (non-sensitive) since January 1 of the current year are exempt from all three mechanisms. The transferred data must not include important data.

This is the tier that matters most for small and mid-size global companies. A SaaS provider exporting analytics data on fewer than 100,000 mainland users in the current calendar year — with no sensitive personal information in the mix — does not need to file an SCC, obtain certification, or pass a security assessment. The exemption is automatic; no application is required.

FTZ negative lists (Art.6)

Free trade zones may compile their own negative lists of data that remains subject to the three mechanisms. Data outside the negative list may be transferred without any mechanism. The contents of these lists are set at the FTZ level; processors operating inside an FTZ should check the applicable list.

Obligations that survive exemption (Art.10)

Exemption from the three mechanisms does not exempt the processor from other PIPL obligations. Notice, separate consent (for cross-border transfers under Article 39), and personal information protection impact assessments remain required regardless of which exemption tier applies.

What this page does not cover

This page covers the three Article 38 transfer mechanisms and the 2024 exemption tiers. It does not cover:

• The PIPL itself — the statute's full scope, Article 3 extraterritorial reach, Article 39 separate-consent requirement, or processing obligations. See the PIPL term page.
• Storage-side data localization — the Article 40 requirement that certain processors store mainland-collected personal information on mainland servers. Localization is the storage question; transfer mechanisms are the movement question. See data residency.
• Cross-border payment settlement — the movement of funds across borders through SAFE-regulated payment channels such as WeChat Pay. That is a money-flow question, not a data-flow question. See cross-border settlement.

Common misconceptions

"The 2024 rules removed the cross-border transfer requirement entirely." They did not. Order No.16 introduced exemptions for defined categories — non-personal data, foreign-collected PI re-exported, necessity-based transfers, and sub-100,000 non-sensitive volume. Transfers above those thresholds still require a mechanism. And all processors, including exempt ones, must still meet PIPL's notice, separate-consent, and impact-assessment obligations (Art.10).

"SCC filing is just signing a contract." The contract must follow the CAC-issued template exactly, it takes effect before any data leaves the mainland, and the processor must file it with the provincial cyberspace department within 10 working days together with an impact assessment report. The filing is a regulatory step, not a private agreement.

"Security assessment validity is 2 years." That was the original term under Order No.11 Art.14. Order No.16 Art.9 extended it to 3 years and introduced a 60-working-day pre-expiry extension window for an additional 3 years, subject to approval.

Frequently asked questions

Sources

Sources: The provisions cited on this page come from three official Chinese texts on gov.cn, accessed 2026-10-02, plus one CAC release page, accessed 2026-10-06 via a web.archive.org snapshot (the live URL returned 403 the same day): 数据出境安全评估办法 (CAC Order No.11, effective 2022-09-01) — www.gov.cn/zhengce/zhengceku/2022-07/08/content_5699851.htm; 个人信息出境标准合同办法 (CAC Order No.13, effective 2023-06-01) — www.gov.cn/gongbao/content/2023/content_5752224.htm; 促进和规范数据跨境流动规定 (CAC Order No.16, effective 2024-03-22) — www.gov.cn/gongbao/2024/issue_11366/202405/content_6954192.html; the 2024-03-22 CAC release 数据出境安全评估申报指南（第二版） (second-edition security-assessment application guide) and 个人信息出境标准合同备案指南（第二版） (second-edition SCC filing guide) — www.cac.gov.cn/2024-03/22/c_1712783131692707.htm. Regulation titles and article glosses on this page are writer translations of the official Chinese texts published at gov.cn and cac.gov.cn, not official translated quotes.

Related terms

• PIPL (个人信息保护法) — It governs the processing of personal information in the mainland. It also applies to processing outside the mainland of personal information of persons inside the mainland when the purpose is offering products or services to persons in the mainland or analyzing and assessing their behavior (Article 3).
• Data Residency in China — the requirement that personal information collected and generated inside the mainland be stored on servers inside the mainland — for a defined class of operators.
• Data Security Law (DSL) — China's framework law for data processing; source of the "important data" trigger that feeds the cross-border security assessment.
• CAC (Cyberspace Administration of China) — China's national cyberspace regulator.

Related reading

• PIPL (个人信息保护法) — the statute behind the three mechanisms; Article 38 transfer bases, Article 39 separate consent, Article 3 offshore reach.
• Data Residency in China — the storage-side localization obligation under PIPL Article 40; the complement to the transfer-mechanism question this page covers.
• Cross-Border Settlement — the money-flow side of cross-border operations; a separate regulatory track from data transfers.
• ICP Compliance Service — how we coordinate entity, filing, and data-governance decisions for global companies entering China.
• Infrastructure Service — mainland hosting and CDN on licensed operators; the infrastructure layer where data-residency and transfer decisions intersect.
• China Digital Entry Glossary — the full term set in one place.