On 1 January 2026 the Measures for the Certification of Outbound Personal Information, jointly issued by the Cyberspace Administration of China (CAC) and the State Administration for Market Regulation, took effect. Adopted at the CAC’s executive meeting in July 2025, the measures are the implementing rules for the certification system established by China’s Personal Information Protection Law (PIPL).
Three routes, now complete
Article 38 of PIPL sets out three routes for outbound personal information: a security assessment organised by the national cyberspace authority; certification of personal information protection by a professional institution; or a standard contract with the overseas recipient.
Before these measures, the security assessment (under the Measures for Security Assessment of Data Export) and the standard contract (under the Measures for Standard Contracts for Outbound Personal Information) were both in place; only certification lacked operational rules. The new measures close that gap.
The measures require that where a personal information processor exports data by certification, it must obtain personal information protection certification from a professional institution, and they set out the management of certification bodies, the certification procedure and follow-up supervision.
Which companies the certification route suits
Each route has its own fit. Security assessment applies where the volume of exported data reaches certain thresholds or where important data is involved; standard contracts suit cases with relatively limited volumes and a stable relationship with the overseas recipient; certification’s value is that it assesses the compliance capability itself rather than each individual transfer.
For AI companies, certification is particularly suited to two situations: where there are many overseas recipients and continuous, frequent transfers make per-transaction standard contracts costly; and where the company wants professional endorsement to demonstrate its personal information protection capability to overseas clients or regulators.
What it means for AI companies
Model-calling scenarios need re-examination. Calling an overseas large-model service may constitute an export of personal information where the input contains personal data. Companies previously relied mostly on standard contracts; certification now adds an option. See our data compliance service and GDPR and cross-border data service.
Note the threshold linkage. According to CAC policy Q&A, a processor that has signed a standard contract or obtained certification must still file a security assessment with the provincial cyberspace authority if, from 1 January of the year, cumulative exports exceed one million individuals’ personal information (excluding sensitive personal information) or 10,000 individuals’ sensitive personal information. Certification is not a one-off.
Certification and filing are distinct. Certification addresses the legality of the export; algorithm filing addresses service compliance. See our note on the duties of large personal information processors and simplified measures for small personal information processors.
Practical steps
Companies can begin by mapping existing cross-border transfers and noting the route each currently uses; assessing which transfers suit a switch from standard contract to certification; and preparing security assessment materials in advance for transfers above the thresholds.
The measures introduce “proof of capability” into outbound data governance. For companies that want to manage cross-border data systematically, it is a route worth evaluating carefully.
This article is based on the Measures for the Certification of Outbound Personal Information and public information from the CAC and the State Administration for Market Regulation. It is for general reference only and does not constitute legal advice.