China Cross-Border Data Transfer: Which of the 3 Paths Do You Fall Under?

Eight out of ten compliance inquiries I receive start with the same question: "Do we need to file a CAC Security Assessment?"

The honest answer for most companies: probably not. But you may still fall into the Standard Contract or Certification track — and that obligation is often overlooked.

Under China's *Regulations on Promoting and Standardizing Cross-Border Data Flows* (effective March 22, 2024), here is the clean three-tier framework every legal counsel should have on file:

Tier 1 — Mandatory CAC Security Assessment
Triggered if any of the following applies:
• Critical Information Infrastructure Operator (CIIO) transferring personal information or important data abroad;
• Any data handler transferring important data abroad;
• Non-CIIO transferring personal information of 1,000,000+ individuals (non-sensitive) cumulatively since January 1 of the current year;
• Transferring sensitive personal information of 10,000+ individuals cumulatively since January 1.

Note: If no authority has formally notified or publicly designated your data as "important data," you are not required to file as such — though internal classification records are still advisable.

Tier 2 — Standard Contract Filing or PI Protection Certification
For non-CIIOs transferring:
• Non-sensitive PI of 100,000 to under 1,000,000 individuals; or
• Sensitive PI of under 10,000 individuals.

Legal basis: PIPL Article 38.

Tier 3 — Exempt
• Non-CIIO transferring non-sensitive PI of under 100,000 individuals;
• Transfers necessary to perform a contract with the individual (cross-border purchase, remittance, ticketing, visa);
• Cross-border HR management under lawful internal rules or collective agreements;
• International trade, cross-border logistics, academic cooperation, and global manufacturing/marketing where no PI or important data is involved;
• Emergency transfers to protect life, health, or property.

Practical guidance from a cross-border lawyer:

The statutory review period is 45 working days, extendable. In practice, intake review and supplemental submissions often consume significantly more time. Build a buffer — do not synchronize your filing timeline with a hard product launch date.

Three recurring blind spots I see in audits:
1. Treating the 100k threshold as the Security Assessment trigger (it is not — it triggers the Standard Contract track);
2. Aggregating sensitive and non-sensitive PI together (they must be counted separately);
3. Starting the count from contract date instead of January 1 of the current year.

If your company is preparing market entry, intra-group data sharing, or an annual compliance baseline, this framework is the first thing to nail down.

Happy to compare notes with in-house counsel and fellow cross-border attorneys.

#CrossBorderData #PIPL #ChinaCompliance #InternationalLaw #DataPrivacy

———
Mike Wu, Attorney-at-Law · Guangdong Jinglang Law Firm · License 144012510953782
Cross-border practice · 4 languages (CN/EN/ES/JA)
Site: wzklaw.com/contact.php?source=linkedin · Book consultation: wzklaw.com/contact.php?source=linkedin
Bar verification: credit.acla.org.cn