China data export: select the CAC path before drafting the transfer documents
Security assessment, China standard contract, certification and current exemption or FTZ routes are different legal paths. Filing the wrong mechanism can force a restart rather than a simple supplement.
Decision guide
Test security assessment first; only then select China SCC, certification or a documented current exemption.
Security assessment applies when the current CAC triggers are met, including relevant CII, important-data, volume or role tests. China SCC is the usual mechanism for many ordinary B2B and HR exports once assessment is ruled out. Certification is a narrower recognised-body route. Exemptions and FTZ lists are versioned and entity-specific; WFOE status is not itself an exemption, and GDPR SCCs do not satisfy the China mechanism.
Map the transfer, write the path memo, then open the matching mechanism.
Classification comes before contracts and filings.
For HR-only transfers, begin with the employee-data map. Use current measurement periods and definitions rather than an old headcount slide.
Do not file China SCC while important data or another live assessment trigger remains in the same transfer pipe. Resolve classification before treating the contract as the compliance answer.
The China data-export mechanism desk
Important-data catalogues, CII status, volume tests and FTZ lists can change. Apply the CAC text in force rather than a remembered 2022 slide.
When each door is tested
The path must be selected before the filing pack is built.
| Decision topic | Security assessmentCAC assessment route | China SCCStandard-contract filing | CertificationRecognised-body route | Exemption / FTZVersioned limited route |
|---|---|---|---|---|
| Primary fit | Required where current CAC assessment triggers apply, including relevant CII, important-data, volume or role tests. | Often the ordinary route for personal-information exports after assessment is ruled out. | A narrower route using an applicable recognised certification mechanism. | A current listed exemption or applicable FTZ list may narrow the mechanism requirement. |
| Wrong assumption | Do not rely on an old headcount or volume figure to rule assessment out. | Do not treat China SCC as the default before checking assessment triggers. | Do not choose certification merely because its name sounds lighter. | WFOE or FTZ status is not a nationwide group-wide free pass. |
Facts that control classification
Inventory the transfer and version the legal tests.
| Decision topic | Security assessmentCAC assessment route | China SCCStandard-contract filing | CertificationRecognised-body route | Exemption / FTZVersioned limited route |
|---|---|---|---|---|
| Trigger inventory | Record CII status, important-data flags, exporter role and the current volume tests. | Confirm the transfer remains within the live SCC-eligible space after assessment screening. | Confirm the actual certification route and its scope are available for the transfer. | Match the precise transfer, entity and zone to the current exemption or FTZ list. |
| HR data | Employee data can still reach an assessment trigger depending on the current facts and rules. | Many ordinary HR exports may use China SCC after the employee-data map and assessment screen. | Do not assume HR data naturally belongs in certification. | Apply only a current exemption that actually covers the employee-data flow. |
| Decision note | For HR-only transfers, complete the employee-data map before choosing among the four doors. | |||
Documents and instrument boundaries
Foreign privacy instruments do not replace the China pathway.
| Decision topic | Security assessmentCAC assessment route | China SCCStandard-contract filing | CertificationRecognised-body route | Exemption / FTZVersioned limited route |
|---|---|---|---|---|
| Contract or evidence pack | Prepare the CAC assessment process and its supporting security and transfer evidence. | Use the China standard contract and complete the required filing workflow. | Build the evidence required by the recognised certification scheme. | Preserve the dated legal text, list entry and facts supporting non-use of a mechanism. |
| GDPR interface | GDPR Chapter V documents do not answer whether CAC assessment is mandatory. | GDPR SCCs do not count as the China standard contract or CAC filing. | A foreign certification does not automatically satisfy the China route. | Foreign-law compliance does not create a China exemption. |
Path memo and operational handoff
Write why the selected route applies and who owns the next filing.
| Decision topic | Security assessmentCAC assessment route | China SCCStandard-contract filing | CertificationRecognised-body route | Exemption / FTZVersioned limited route |
|---|---|---|---|---|
| Decision memo | State the live trigger that requires assessment. | State why assessment does not apply and why China SCC does. | State why the recognised certification route fits this transfer. | Cite the current exemption or FTZ list and its entity-specific application. |
| Next workflow | Open the CAC security-assessment workstream rather than a provincial SCC upload. | Open the maintained China SCC filing workflow. | Engage the appropriate certification route and evidence owner. | Monitor the versioned rule and reassess when facts or lists change. |
Remove stale shortcuts from the path memo.
The mechanism decision fails when teams substitute entity labels or foreign documents for current CAC analysis.
Using last year’s headcount as law
Current volume, period and role tests must be taken from the CAC text in force.
Treating an FTZ rumour as exemption
Lists can be narrow, local, entity-specific and change over time.
Uploading GDPR SCCs and stopping
GDPR contractual clauses do not satisfy the China standard-contract mechanism.
Starting with contract drafting
The correct mechanism must be selected before the filing pack is built.
Approve the trigger table and mechanism handoff.
Selections stay in this browser and are not submitted.
Questions teams ask at the mechanism fork.
CAC pathways, volume tests and FTZ lists can change; confirm current rules and facts.
If we are in an FTZ, can we skip all CAC paths?
No. Some zones publish lists that narrow what requires a mechanism, but they are not a nationwide free pass and must be applied to the relevant entity and transfer.
Is certification easier than China SCC?
It is different and often narrower. Do not choose it because the name sounds lighter; write the path memo first.
Do GDPR SCCs satisfy the China filing requirement?
No. GDPR SCCs and the China standard-contract mechanism are separate instruments.
Are employee-data exports automatically exempt?
No. Complete the employee-data map, then apply the current assessment, SCC, certification and exemption rules.
Maintained data-export route station
Use the maintained operational guides after the mechanism has been selected.
Continue into the workflow that owns the selected route.
This decision desk selects the mechanism; the connected guides own mapping and filing execution.
Cross-Border Data Transfer Roadmap
Build the systems, data, recipient and legal-basis inventory.
Open specialist route →02 · Standard contractChina SCC Filing Workflow
Prepare the standard contract, assessment and filing sequence.
Open specialist route →03 · Employee dataTransferring Employee Data
Map HR systems and employee-data flows before choosing the mechanism.
Open specialist route →Escalate when assessment triggers, important data or an exemption cannot be safely classified.
Qualified China data counsel should confirm the current CAC mechanism before contracts or system changes are treated as final.
Important data may be presentCatalogue status and the security-assessment route require current analysis.
CII or volume status is unclearThe exporter role, measurement period and current threshold must be resolved.
An FTZ list is being relied onConfirm the exact entity, transfer and live list entry.
Several mechanisms appear possibleDocument why the selected route displaces the others before filing.
Educational information only — not legal advice. CAC pathways, volume tests, important-data catalogues and FTZ lists can change. Confirm current rules and facts before selecting or filing a mechanism.
