LexLint

Know the law your code answers to.

Law / China

Personal Information Protection Law, Cross-Border Transfer

PIPL Arts. 38-40

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 November 2021.

A cross border transfer rule binding public and private bodies.

As of 23 August 2026.

What it requires

  • Complete a CAC security assessment, personal-information-protection certification, or CAC standard contract before transferring personal information out of China, unless a specific exemption applies.
  • Give advance notice disclosing the overseas recipient's identity and contact details, and obtain the individual's separate consent, before transferring their personal information abroad.
  • Store personal information collected within China domestically if operating as a critical information infrastructure operator or processing above the state-set volume threshold; export only after a security assessment.

Who checks it

Audit expectation

none

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Article 38 requires one of a CAC-organized security assessment, personal-information-protection certification, a CAC standard contract, or another state-recognized mechanism before transferring personal information outside China, plus assurance the overseas recipient meets PIPL's protection standard. Article 39 requires advance notice naming the recipient and purpose and separate consent.

Article 40 requires domestic storage for critical information infrastructure operators and above-threshold handlers, with export gated on a security assessment. The 2024 CAC Provisions on Promoting and Regulating Cross-Border Data Flows (a separate instrument) substantially relax these mechanisms by transfer volume.

When LexLint raises it

  • crawls_web
  • trains_models
  • processes_voice
  • processes_biometrics

Read the law

official CAC-published full Chinese statutory text

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example  ·  Lint your app