Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

China: CAC issues Standard Contract Measures for Exports of Personal Information

The Cyberspace Administration of China ('CAC') announced, on 24 February 2023, the publication of the Standard Contract Measures for Exporting Personal Information, which were adopted on 3 February 2023. In particular, the CAC highlighted that the measures apply to personal information processors who provide personal information outside the People's Republic of China by concluding a standard personal information export contract with an overseas recipient. More specifically, the measures provide that personal information processors providing information overseas by means of a standard contract, must meet the following conditions:

  • be considered as non-critical information infrastructure operators;
  • handle the personal information of less than one million people;
  • have provided the personal information abroad of less than 100,000 people since 1 January of the previous year; and
  • have provided the sensitive personal information abroad of less than 10,000 people since 1 January of the previous year.

In addition, the measures specify that personal information processors must conduct a personal information impact assessment before providing personal information overseas, stipulating that assessments should focus on:

  • the legality, legitimacy, and necessity of the purpose, scope, and method of processing personal information by the personal information processor and overseas recipient;
  • the scale, scope, type, and sensitivity of the personal information exported abroad, and the risks that the export of personal information may bring to the rights and interests of data subjects;
  • whether the overseas recipient has promised to undertake the obligations, and whether the management and technical measures and capabilities to fulfil the obligations can guarantee the security of outgoing personal information;
  • the risk of personal information being tampered with, destroyed, leaked, lost, or illegally used in the third country;
  • the impact of personal information protection policies and regulations of the third country on the standard contract; and
  • other matters that may affect personal information security.

Further, the measures note that personal information processors must reassess the protection of personal information and supplement or re-conclude the standard contract where:

  • the purpose, scope, category, degree of sensitivity, method, storage location of personal information provided overseas, or the purpose and method of processing personal information by an overseas recipient changes, or the retention period is extended;
  • the personal information policies and regulations of the third country change so that they may affect the rights and interests of data subjects; or
  • other circumstances affect the rights and interests of personal information.

Finally, the CAC detailed that the measures enter into force on 1 June 2023.

You can read the announcement here, the measures here, and a set of frequently asked questions regarding the measures here, all only available in Chinese.

Feedback