Law note · China
Provisions on Promoting and Regulating Cross-Border Data Flows
This CAC regulation relaxes PIPL Article 38's cross-border transfer mechanisms by transfer volume, recited in the CAC promulgation notice. Exporting under 100,000 individuals' non-sensitive personal information in a year, or a listed necessary-business category such as contract performance, cross-border human-resources management, or emergency protection of life or property, needs no security assessment, standard contract, or certification at all.
Exporting 100,000 to under 1,000,000 individuals' non-sensitive personal information, or under 10,000 individuals' sensitive personal information, needs a standard contract or certification. Exporting 1,000,000 or more individuals' non-sensitive personal information, or 10,000 or more individuals' sensitive personal information, or any export by a critical information infrastructure operator, needs the full CAC security assessment. Free trade zones may adopt their own negative lists further narrowing what requires a mechanism.
What it asks of an app
- Confirm which volume tier applies before exporting personal information from China: under 100,000 individuals' non-sensitive personal information a year (or a listed necessary-business exemption) needs no mechanism, 100,000 to under 1,000,000 needs a standard contract or certification, and 1,000,000 or more, or sensitive personal information export above 10,000 individuals, needs the full CAC security assessment.
- Complete a security assessment before any cross-border personal information export if operating as a critical information infrastructure operator, regardless of volume.
When LexLint raises it
Declared activities: crawls_web, trains_models, processes_voice, processes_biometrics