4 questions before you choose the route.
This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.
What is leaving China?
PI, SPI, important data, or mixed.
DataWho is the exporter?
CIIO vs ordinary handler vs group HQ.
ExporterWhich path is open?
Assessment, SCC, certification, or a current exemption.
PathDid the threshold move?
Resolve the did the threshold move question separately before choosing the route.
DateWorking rule: If you provide personal information collected in China to a recipient outside the PRC, you are generally in a regulated export.
The signal ledger.
These facts move the question beyond a label and into a product, money-flow and control analysis.
Bring a compact evidence docket—not a pitch deck.
Give a compliance team or counsel the operating facts that reveal the perimeter.
Questions people ask before they build.
Short answers for orientation. The right result can change with the service model and current rules.
Is a US DPA enough?
No. A GDPR DPA does not replace a PIPL export tool.
Where are the numeric thresholds?
In the current CAC measures. This page will not reprint a number that can stale overnight.
Primary authorities
Reviewed sources support orientation, not a fact-specific assessment.




