China. Data localisation / cross-border. Departmental rules
Cross-Border Data Flow ProvisionsProvisions on Promoting and Regulating Cross-Border Data Flows (促进和规范数据跨境流动规定)
In force
§1Summary
- Synopsis
CAC rules that relaxed China's data export regime by exempting common scenarios and resetting volume thresholds. They decide whether an exporter needs a security assessment, a standard contract/certification, or nothing.
- Key themes
- Unique features
Exempts transfers needed to perform contracts with the individual and cross-border HR, and exempts non-sensitive PI of under 100,000 people per year; pilot FTZs may publish negative lists.
- SaaS relevance
Determines which export route a SaaS provider serving Chinese users must use; many B2C contract-necessity flows are now exempt.
§2Obligations
- Cross-border transfers
- <100k non-sensitive PI/yr exempt; 100k–1m non-sensitive or <10k sensitive: SCC filing or certification; >1m non-sensitive, >10k sensitive, important data or CII: security assessment
- Maximum penalty
- Per PIPL/DSL
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text cac.gov.cn
- English text chinalawtranslate.com
- Authority
- Cyberspace Administration of China (CAC)
§5Where it applies
- Domestic law of
- China
§6Sources and verification
- Verification
High confidence.
Took effect on promulgation; volume counted from 1 January of the current year.