China. Data localisation / cross-border. Departmental rules
Security Assessment MeasuresMeasures for the Security Assessment of Outbound Data Transfers (数据出境安全评估办法)
In force
§1Summary
- Synopsis
Sets the procedure for the CAC-run security assessment required for the highest-risk data exports. The exporter self-assesses, files through the provincial CAC and must obtain approval before transferring.
- Key themes
- Unique features
Pre-approval licensing model for data exports, unlike notification-based regimes elsewhere.
- SaaS relevance
A SaaS provider exporting large-volume or sensitive PI from China (or any important data) needs CAC approval first.
§2Obligations
- Cross-border transfers
- CAC approval required above thresholds
- Maximum penalty
- Per PIPL/DSL
§3Dates
- Key dates
- Adopted
- In force
- Thresholds and validity (now 3 years, extendable) modified by 2024 Cross-Border Data Flow Provisions
§4Text and authority
- Text
- Authoritative text cac.gov.cn
- English text digichina.stanford.edu
- Authority
- Cyberspace Administration of China (CAC)
§5Where it applies
- Domestic law of
- China
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Original 2-year validity extended to 3 years by 2024 Provisions.