China Cross-Border Data Flow Provisions

What it does

Relaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.

Who it applies to

Data processors exporting data from China. Non-CII processors: fewer than 100,000 individuals' non-sensitive PI per year is exempt (Art. 5); 100,000 to under 1 million non-sensitive PI, or fewer than 10,000 individuals' sensitive PI, needs a standard contract or certification (Art. 8); 1 million+ non-sensitive PI, 10,000+ sensitive PI, or any important data needs a CAC security assessment (Art. 7). CII operators exporting PI or important data always need an assessment.

Penalties

Enforced through PIPL, DSL and CSL penalties (e.g. PIPL up to RMB 50 million or 5% of turnover; DSL up to RMB 10 million for serious unlawful important-data exports).

Enforced by

Cyberspace Administration of China (national and provincial)

Official name

Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16)

Citation

CAC Order No. 16

Topics

data-residency, privacy