On 22 March 2024 the Cyberspace Administration of China published the Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16), effective on publication. The provisions keep the three-path structure but adjust the trigger thresholds and the scope of exemptions. The practical impact is concentrated in two questions: which transfers no longer require filing, and how headcount is counted.
The three paths
- Security assessment. Critical information infrastructure operators transferring personal information abroad, or any entity transferring important data; and personal information transfers that reach the numerical threshold.
- Standard contract or certification. Transfers above the exemption threshold but below the assessment threshold may choose between a standard contract and personal information protection certification.
- Exemption. Transfers falling within specified circumstances may be exempt from filing, standard contracts and certification.
Headcount is calculated by natural persons, with sensitive and ordinary personal information counted separately. The specific bands follow the text of the provisions; companies should not rely on the previous approach.
Exemptions and the free-trade-zone list
The provisions list circumstances exempt from filing, including contract performance, cross-border transport, academic cooperation, multinational human-resources management and emergencies. Each exemption assumes that the purpose and scope of the transfer match the stated circumstance; a human-resources label cannot cover bulk exports.
A second change is the free-trade-zone negative list. Zones may designate data that requires management; data outside the list is not subject to the three paths. Each zone publishes its own list, so companies must confirm the version that applies where they operate.
Three things to redo
- Recount headcount. Count natural persons rather than records, separate sensitive from ordinary information, and confirm whether a threshold is still met.
- Reassess the scenario. Check each transfer against the exemptions and document the basis in writing rather than by verbal judgment.
- Redo the agreements. Standard contracts, notices and consent and the obligations of overseas recipients must match the new thresholds; materials prepared under the old rules may no longer apply.
For route selection see data compliance and cross-border data; for offshore structuring see offshore structure. Definitions are in the glossary.
This article is based on the Provisions on Promoting and Regulating Cross-Border Data Flows published by the Cyberspace Administration of China on 22 March 2024, and on public information. It is for reference only and does not constitute legal advice.