China Privacy Law personal information cross-border transfer routes

First confirm what is provided overseas, from where, to whom, and for what purpose. A flow with no personal information or important data falls outside the three route mechanisms under the 2024 provisions. Personal information collected overseas, sent into China for processing, and then sent back out is also exempt if the China processing introduces no personal information collected in China and no important data.

For important data, follow the applicable identification and declaration rules. If a department or region has not notified the processor or publicly classified the data as important data, Article 2 of the 2024 provisions says the processor does not need to declare a security assessment on the basis that it is important data.

After applying the exemptions, security assessment is mandatory for a CIIO providing personal information or important data overseas. It is also mandatory for a non-CIIO providing important data, personal information of at least 1 million individuals excluding sensitive information, or sensitive personal information of at least 10,000 individuals, counted cumulatively from 1 January of the current year.

A non-CIIO in the intermediate bands must use either the CAC standard contract or personal information protection certification: at least 100,000 but fewer than 1 million individuals for non-sensitive personal information, or fewer than 10,000 individuals for sensitive personal information. Because the sub-100,000 volume exemption excludes sensitive personal information, even a smaller sensitive-information export can enter this intermediate band unless another Article 5 or 6 exemption applies. Apply the exemptions first, and do not use quantity splitting to avoid a mandatory security assessment.

A route exemption does not mean that the transfer is outside China's Personal Information Protection Law (PIPL). For overseas provision of personal information, apply the Article 39 notice and separate-consent duties where the law requires them, complete the Article 55 PIPIA, and take necessary measures to ensure that the overseas recipient's processing meets PIPL's protection standard.

Keep a route file that a reviewer can recalculate. Counts are cumulative from 1 January of the current year and separate sensitive from non-sensitive personal information. Reopen the conclusion when data, recipients, purposes, methods, retention, destination law, control, CIIO status, important-data status, or counts change.