Law note · China
Personal Information Protection Law, Cross-Border Transfer
Article 38 requires one of a CAC-organized security assessment, personal-information-protection certification, a CAC standard contract, or another state-recognized mechanism before transferring personal information outside China, plus assurance the overseas recipient meets PIPL's protection standard. Article 39 requires advance notice naming the recipient and purpose and separate consent.
Article 40 requires domestic storage for critical information infrastructure operators and above-threshold handlers, with export gated on a security assessment. The 2024 CAC Provisions on Promoting and Regulating Cross-Border Data Flows (a separate instrument) substantially relax these mechanisms by transfer volume.
What it asks of an app
- Complete a CAC security assessment, personal-information-protection certification, or CAC standard contract before transferring personal information out of China, unless a specific exemption applies.
- Give advance notice disclosing the overseas recipient's identity and contact details, and obtain the individual's separate consent, before transferring their personal information abroad.
- Store personal information collected within China domestically if operating as a critical information infrastructure operator or processing above the state-set volume threshold; export only after a security assessment.
When LexLint raises it
Declared activities: crawls_web, trains_models, processes_voice, processes_biometrics
Primary source: official CAC-published full Chinese statutory text