ChinaPersonal Information Protection Law, Cross-Border Transfer
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Complete a CAC security assessment, personal-information-protection certification, or CAC standard contract before transferring personal information out of China, unless a specific exemption applies.NIST Privacy FrameworkCT.PO-P2
- Give advance notice disclosing the overseas recipient's identity and contact details, and obtain the individual's separate consent, before transferring their personal information abroad.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P1
- Store personal information collected within China domestically if operating as a critical information infrastructure operator or processing above the state-set volume threshold; export only after a security assessment.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkID.IM-P7
These lines are LexLint's reading of the law's text. Also read by: Cyberspace Administration of China (国家互联网信息办公室), the national cyberspace department that coordinates personal information protection and supervision under the Personal Information Protection Law (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.IM-P7The data processing environment is identified (e.g., geographic location, internal, cloud, third parties).
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.cac.gov.cn/2026-07/24/c_1786638883119336.htm
- Guidance body
- Cyberspace Administration of China (国家互联网信息办公室), the national cyberspace department that coordinates personal information protection and supervision under the Personal Information Protection Law
- Open questions
- Which international treaties and agreements, described in Article 38 as 中华人民共和国缔结或者参加的国际条约、协定 ("international treaties and agreements that the People’s Republic of China has concluded or acceded to"), set conditions for providing personal information outside China that a handler may follow in place of the mechanisms in items 1 to 4?
What it makes you log
Logging duty
Articles 38 to 40 require a CAC security assessment, certification or the standard contract, notice and separate consent, and domestic storage by critical information infrastructure operators and large handlers. None of them requires a log, register or record. The impact assessment before an outbound transfer and its three-year record are required by Articles 55 and 56, held on a separate row.
- Kind
- None
- As of
What this law does
Article 38 requires one of a CAC-organized security assessment, personal-information-protection certification, a CAC standard contract, or another state-recognized mechanism before transferring personal information outside China, plus assurance the overseas recipient meets PIPL's protection standard. Article 39 requires advance notice naming the recipient and purpose and separate consent.
Article 40 requires domestic storage for critical information infrastructure operators and above-threshold handlers, with export gated on a security assessment. The 2024 CAC Provisions on Promoting and Regulating Cross-Border Data Flows (a separate instrument) substantially relax these mechanisms by transfer volume.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .