ChinaProvisions on Promoting and Regulating Cross-Border Data Flows
促进和规范数据跨境流动规定, issued by the Cyberspace Administration of China, effective
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Confirm which volume tier applies before exporting personal information from China: under 100,000 individuals' non-sensitive personal information a year (or a listed necessary-business exemption) needs no mechanism, 100,000 to under 1,000,000 needs a standard contract or certification, and 1,000,000 or more, or sensitive personal information export above 10,000 individuals, needs the full CAC security assessment.
- Complete a security assessment before any cross-border personal information export if operating as a critical information infrastructure operator, regardless of volume.
These lines are LexLint's reading of the law's text. Also read by: Cyberspace Administration of China (国家互联网信息办公室), the national cyberspace department that coordinates personal information protection and supervision under the Personal Information Protection Law (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.cac.gov.cn/2026-07/24/c_1786638883119336.htm
- Guidance body
- Cyberspace Administration of China (国家互联网信息办公室), the national cyberspace department that coordinates personal information protection and supervision under the Personal Information Protection Law
- Open questions
- How are the figures for non-sensitive and sensitive personal information combined under Articles 7 and 8 when a processor exports both, given that each article counts people 自当年1月1日起累计 ("cumulatively from 1 January of the current year")?
What it makes you log
Logging duty
The Provisions fix which outbound transfers need a security assessment, a standard contract or certification, and which are exempt. Article 10 tells a handler to meet the notice, separate consent and impact assessment duties that other laws set, and Article 11 requires a report to the provincial cyberspace administration on a data security incident; neither creates a record duty here, and the impact assessment record is required by PIPL Articles 55 and 56, held on a separate row. Article 12 has the cyberspace departments supervise transfers and order rectification of risk, which is coded as an on-request check by the regulator.
- Kind
- None
- As of
What this law does
This CAC regulation relaxes PIPL Article 38's cross-border transfer mechanisms by transfer volume, recited in the CAC promulgation notice. Exporting under 100,000 individuals' non-sensitive personal information in a year, or a listed necessary-business category such as contract performance, cross-border human-resources management, or emergency protection of life or property, needs no security assessment, standard contract, or certification at all.
Exporting 100,000 to under 1,000,000 individuals' non-sensitive personal information, or under 10,000 individuals' sensitive personal information, needs a standard contract or certification. Exporting 1,000,000 or more individuals' non-sensitive personal information, or 10,000 or more individuals' sensitive personal information, or any export by a critical information infrastructure operator, needs the full CAC security assessment. Free trade zones may adopt their own negative lists further narrowing what requires a mechanism.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .