#
Transfer mechanisms are well-established and increasingly detailed, but thresholds have shifted multiple times since 2022 and important-data classification remains only partially settled, creating ongoing compliance uncertainty.
Sub-modules (6)
Transfer MechanismsAmber
Article 38 provides three transfer mechanisms: CAC-led security assessment (for CIIOs/large-volume processors), CAC-authorized certification, and the Chinese standard contract.
Claims (1):
- PIPL Article 38 offers three cross-border data transfer mechanisms depending on the characteristics of the exporting entity: a CAC-led security assessment (mandatory for CIIOs and large-volume processors), a PI-protection certification issued by CAC-authorized professional institutions, or a standard-contract agreement with the overseas recipient based on CAC-issued clauses.
Adequacy ReceivedRed
PIPL does not provide a mechanism for cross-border transfers premised on adequacy decisions from other jurisdictions, in contrast with GDPR Art 45.
Claims (1):
- Unlike GDPR, PIPL does not provide for cross-border transfers of personal information premised on a finding of 'adequate protection' in the recipient jurisdiction; all outbound transfers must instead satisfy one of PIPL's three domestic transfer mechanisms.
Adequacy GrantedRed
No evidence was found of China issuing formal 'adequacy' determinations toward other jurisdictions; its transfer regime is structured around security assessment, SCC and certification rather than a unilateral-adequacy concept.
Sccs And BcrsAmber
The Chinese SCCs (effective 1 June 2023) require Chinese law as the governing law, use a single universal contract template regardless of controller/processor role, and must be filed with the provincial CAC within 10 working days of effectiveness together with the impact assessment report.
Claims (1):
- The Chinese Standard Contractual Clauses, effective 1 June 2023, require the cross-border data transfer agreement to be governed by Chinese law, use a single universal template regardless of the parties' controller/processor role, and be filed with the provincial CAC together with the impact assessment report within 10 working days of effectiveness.
Transfer Impact AssessmentAmber
SCC-based (and security-assessment-based) transfers require an accompanying impact assessment report; the assessment must be redone and re-filed with the provincial CAC upon material changes such as extended retention, altered purpose/scope/volume/sensitivity, or changes in the destination country's data protection laws.
Claims (1):
- Parties to an SCC-based cross-border transfer must redo the impact assessment, update the transfer agreement, and re-file with the provincial CAC where circumstances materially change, including extension of retention period, changes in processing purpose/scope/category/volume/storage location/sensitivity, or changes in the destination country's data protection laws affecting data subjects.
Data LocalisationAmber
CIIOs and processors handling large volumes of personal information must store personal information locally in China, with overseas transfer conditioned on passing a CAC security assessment (Art 40); the March 2024 CBDT relaxations raised numeric thresholds and exempted several transfer scenarios (e.g., employee data) from any CBDT mechanism.
Claims (1):
- CIIOs and entities processing large volumes of personal information must store citizens' personal information and important data locally in China, with overseas transfer conditioned on passing a CAC-led security assessment; the March 2024 CBDT Provisions relaxed thresholds so that non-CIIO handlers transferring between 100,000 and 1,000,000 individuals' data (or under 10,000 individuals' sensitive data) may use SCC/certification rather than a full security assessment, and exempted employee-data transfers from any CBDT mechanism regardless of volume where employment-law conditions are met.
Cross-Border & Adequacy
China's cross-border personal information transfer framework reached structural completion this cycle. The Measures for Certification of Cross-Border Personal Information Transfer, effective 1 January 2026, complete the three-pathway framework under PIPL: security assessment, standard contract, and certification. This is a confirmed, materially significant development: prior to this measure, the certification pathway existed in name but lacked the operational detail now supplied, and the framework's completion gives data controllers a genuine choice among three distinct compliance routes rather than a binary choice between the two previously-operational pathways.
From the same 1 January 2026 effective date, data controllers otherwise required to use China's Standard Contractual Clauses now have the option of obtaining certification instead, introducing a new compliance-pathway optionality that did not previously exist in practice. This is probably significant for multinational data controllers who had defaulted to the Standard Contractual Clauses route in the absence of an operational certification alternative, and who may now find certification a more suitable pathway depending on their specific transfer profile and volume.
A further requirement reported this cycle, though on weaker single-source evidence, holds that every PIPL cross-border transfer requires a current Personal Information Protection Impact Assessment on file. This claim rests on uncorroborated secondary compliance guidance rather than independently verified primary-source confirmation, so it should be read as an unconfirmed compliance expectation rather than a settled requirement pending further verification. Separately, the precise current volume thresholds distinguishing which of the three pathways applies to a given transfer were reported inconsistently across secondary sources this cycle and were not verified against the primary Cyberspace Administration of China measures text directly, a gap that limits the precision with which controllers can currently map their own transfer volumes to the correct compliance pathway.
Outlook
Watch for primary-source verification of the current cross-border transfer volume thresholds governing pathway selection, and for whether the reported PIPIA-for-every-transfer requirement is corroborated by additional independent sourcing or clarified as a narrower requirement applying only to certain transfer categories. The completion of the three-pathway framework itself is not expected to change further in the near term absent a fresh regulatory intervention.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (5)
- ProbableIAPP — PIPL Article 38 offers three cross-border data transfer mechanisms depending on the characteristics of the exporting entity: a CAC-led security assessment (mandatory for CIIOs and large-volume processors), a PI-protection certification issued by CAC-authorized professional institutions, or a standard-contract agreement with the overseas recipient based on CAC-issued clauses.observed
- ProbableOneTrust DataGuidance — Unlike GDPR, PIPL does not provide for cross-border transfers of personal information premised on a finding of 'adequate protection' in the recipient jurisdiction; all outbound transfers must instead satisfy one of PIPL's three domestic transfer mechanisms.observed
- ProbableIAPP — The Chinese Standard Contractual Clauses, effective 1 June 2023, require the cross-border data transfer agreement to be governed by Chinese law, use a single universal template regardless of the parties' controller/processor role, and be filed with the provincial CAC together with the impact assessment report within 10 working days of effectiveness.observed
- ProbableIAPP — Parties to an SCC-based cross-border transfer must redo the impact assessment, update the transfer agreement, and re-file with the provincial CAC where circumstances materially change, including extension of retention period, changes in processing purpose/scope/category/volume/storage location/sensitivity, or changes in the destination country's data protection laws affecting data subjects.observed
- ProbableIAPP — CIIOs and entities processing large volumes of personal information must store citizens' personal information and important data locally in China, with overseas transfer conditioned on passing a CAC-led security assessment; the March 2024 CBDT Provisions relaxed thresholds so that non-CIIO handlers transferring between 100,000 and 1,000,000 individuals' data (or under 10,000 individuals' sensitive data) may use SCC/certification rather than a full security assessment, and exempted employee-data transfers from any CBDT mechanism regardless of volume where employment-law conditions are met.observed