China. Data localisation / cross-border. Departmental rules
PI Export Certification MeasuresMeasures for Certification of Outbound Transfer of Personal Information (个人信息出境认证办法)
In force
§1Summary
- Synopsis
Jointly issued CAC/SAMR rules that complete the certification route for exporting personal information as an alternative to the standard contract. Exporters need separate consent and a PI impact assessment, then undergo technical verification and on-site review by an accredited body.
- Key themes
- Unique features
Certificate valid three years with ongoing supervision; anti-splitting rule prevents dividing volumes to avoid security assessment.
- SaaS relevance
Lets SaaS groups certify a transfer arrangement once instead of filing contracts per transfer, within the SCC-tier volume band.
§2Obligations
- Cross-border transfers
- Alternative to SCC for non-CII handlers exporting 100k–1m PI or <10k sensitive PI per year
- Maximum penalty
- Per PIPL
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text cac.gov.cn
- Authority
- Cyberspace Administration of China (CAC) and State Administration for Market Regulation (SAMR)
§5Where it applies
- Domestic law of
- China
§6Sources and verification
- Verification
High confidence.
[Link: official Chinese (CAC); no verified free English translation found]