Direct answer

Assessment is a CAC review of the export — not a notary stamp on your SCC.

PIPL and CAC measures require a security assessment through CAC (via provincial cyberspace authorities) when statutory triggers are met: CII operators exporting PI, export of important data, and PI export above current volume or sensitive-volume triggers. The file typically includes a self-assessment, contracts, and security materials. Timelines are measured in months, not days. Passing assessment is not a permanent private licence — watch validity and change-of-circumstance rules. This page will not print a volume number that CAC can amend.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

01

Is a trigger met?

CII, important data, current volume/SPI bands.

Trigger
02

Who files?

The PRC exporter / handler, not the overseas parent alone.

Filer
03

What is in the pack?

Self-assessment, contracts, security.

Pack
04

What if you are under the trigger?

SCC or certification sibling.

Else

Working rule: Map the regulated role before marketing or launch in China.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal
Ask the operating question
Why it changes the route
SCC instead of assessment
Are you filing SCC because assessment is slow?
Wrong tool can be an illegal export.
Frozen 2022 numbers
Are you quoting an old million-person figure as gospel?
Re-read the current measures.
One-and-done
Did the business change after a pass?
Re-assessment / change rules exist.
Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Trigger memoWhy assessment applies, with current legal text.
02Data mapTypes, volume method, recipients, destinations.
03Security packEncryption, access, incident, subcontractors.
Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

How long does it take?

Plan in months. Do not book a go-live on a wiki guess.

Can we export while it is pending?

Generally no for the triggered export. Seek counsel on transitional facts.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

PIPL (NPC / official text)
Cyberspace Administration of China
National laws database (NPC)
gov.cn policy releases