Provisions on Promoting and Regulating Cross-Border Data Flows
促进和规范数据跨境流动规定（国家互联网信息办公室令第 16 号）. Published and effective 22 March 2024. It does not replace the three transfer routes — it defines when you do not need them, and where the thresholds sit.
In one line
China's cross-border regime is flow-level and threshold-driven: depending on how much personal information leaves the country in a calendar year, you either need nothing, a filed standard contract or certification, or a full security assessment.
The three routes (from PIPL Article 38)
- Security assessment by the CAC.
- Standard contract with the overseas recipient, filed with the provincial CAC.
- Personal information protection certification.
The thresholds (from the 2024 Provisions)
| Cumulative volume from 1 January of the year | What is required | Article |
|---|---|---|
| Under 100,000 individuals' personal information, with no sensitive PI and no important data | Exempt — no assessment, contract or certification | Art. 5(4) |
| 100,000 to under 1,000,000 individuals' PI (excluding sensitive), or under 10,000 individuals' sensitive PI | Standard contract or certification | Art. 8 |
| 1,000,000 or more individuals' PI (excluding sensitive), or 10,000 or more individuals' sensitive PI, or any important data | Security assessment | Art. 7(2) |
| Any transfer of personal information or important data by a critical information infrastructure operator (CIIO) | Security assessment, whatever the volume | Art. 7(1) |
Three things the table makes easy to miss:
- Sensitive personal information has no small-volume exemption. The
under 100,000exemption is expressly limited to personal information that is not sensitive, so a single sensitive record already needs a standard contract or certification. - The CIIO rule is about who you are, not how much you move. Articles 3 and 4 still exempt a CIIO — data carrying no personal information and no important data can always leave — but no other exemption does.
- A security assessment result is worth more than it used to be: valid for 3 years, extendable once by another 3 on application within 60 working days before it expires (Art. 9).
Exemptions listed in the 2024 Provisions
- No personal information and no important data (Art. 3): international trade, cross-border transport, academic cooperation, cross-border manufacturing and marketing.
- Passed through, not gathered here (Art. 4): personal information collected and generated abroad, processed in China and sent out again, where the processing introduced no domestic personal information or important data.
- Necessary for a contract the individual is a party to (Art. 5(1)): cross-border shopping, delivery, remittance, payment, account opening, flight and hotel booking, visa applications, exam services.
- Cross-border HR management (Art. 5(2)): staff personal information sent under lawfully adopted employment rules and a lawfully concluded collective contract.
- Emergency (Art. 5(3)): necessary to protect a person's life, health or property.
- Small volume (Art. 5(4)): under 100,000 individuals in the calendar year — non-sensitive only, and never important data.
Free trade zones may issue their own negative lists (Art. 6): data outside the list needs no route at all.
A further relaxation is easy to miss — you must declare important data only if a department or region has told you, or publicly listed it, as important (Art. 2).
Relationship to other instruments
- PIPL Article 38 creates the three routes; the 2024 Provisions adjust the thresholds and the exemptions.
- Measures for Security Assessment of Data Exports (Order No. 11, published 2022-07-07, effective 2022-09-01) govern the assessment procedure.
- Measures for the Standard Contract for Export of Personal Information (Order No. 13, published 2023-02-22, effective 2023-06-01) govern filing and content.
- Measures for Certification of Personal Information Export (CAC and SAMR Order No. 20, published 2025-10-14, effective 2026-01-01) govern the certification route: https://www.cac.gov.cn/2025-10/17/c_1762449728720008.htm — its Article 5 confirms who may use it: a non-CIIO exporter moving 100,000–1,000,000 individuals' non-sensitive personal information, or under 10,000 individuals' sensitive personal information, and never important data.
- Where the older measures and the 2024 Provisions disagree, the 2024 Provisions prevail (Art. 13).
Unverified / TODO
- Confirm the article-level wording of each threshold against the official text — done 2026-10-07 (Arts. 5, 7, 8)
- Confirm the CIIO rule's current form after the 2024 Provisions — done: Art. 7(1), with Arts. 3 and 4 still exempting
- Add the official link for the certification measures and their effective date — done: Order No. 20, effective 2026-01-01
- Note any sectoral "important data" catalogues
- Track the certification rules and technical standards that Order No. 20 Article 4 assigns to SAMR and the CAC