Direct answer: start with the facts, not the name of a statute. If mainland-China data is accessible abroad, screen for personal information, sensitive personal information and important data; then test the exemptions and thresholds below. A mechanism exemption does not remove the PIPL duties that still apply. The working output should be a decision memo, evidence pack, next deadline and a short list of unresolved facts for China counsel.
1. What must a foreign business decide?
Determine what actually crosses the mainland-China boundary, classify it, identify the people and systems involved, calculate cumulative individuals from 1 January, and test important-data, CII, sector and FTZ rules before choosing a route. Do not treat an exemption from security assessment, SCC and certification as an exemption from PIPL notice, necessity, impact-assessment, security or rights obligations.
| Input fact | Decision | Required output | Escalate when |
|---|---|---|---|
| Remote access, API, replication or file transfer | Is data made available outside mainland China? | Data-flow and access map | Architecture or recipient location is unclear |
| Fields, purpose and affected people | PI, sensitive PI, non-PI or potential important data? | Classification record | Sector catalogue or data status is uncertain |
| CII status, annual counts and scenario | Assessment, SCC, certification or mechanism exemption? | Route memo and calculation | A threshold, exemption condition or CII status is uncertain |
| Notice, legal basis, necessity and controls | What substantive PIPL duties remain? | PIPIA, notice/consent record and control evidence | Necessity or legal basis is contested |
| Changes to data, recipient, purpose or volume | Does the conclusion, filing or approval remain valid? | Change log and review date | Actual activity drifts from the approved scope |
2. China Data Route Engine
- Security assessment is the high-volume or important-data path.
- The standard contract is the common intra-group path when thresholds allow it.
- Certification is an alternative group mechanism, not a shortcut around facts.
- An exemption can remove a mechanism but not notice, consent or PIPIA where they still apply.
Use this as a screening tree, not an automated legal opinion. A “yes” or “no” must be supported by the evidence shown in the right-hand column.
| Step | Question | If yes | If no / evidence |
|---|---|---|---|
| 1 | Will data collected or generated in mainland China be accessible outside mainland China? | Continue to classification. | Document the architecture and access controls; apply domestic duties. |
| 2 | Does it contain PI, sensitive PI or data officially identified as important? | Separate each category and count PI. | For non-PI/non-important data generated in listed international activities, test Article 3. |
| 3 | Has the data been notified or publicly identified as important data? | Security-assessment route is relevant. | Article 2 says a processor need not file merely on speculation; still screen sector/local catalogues. |
| 4 | Is the exporter a CII operator? | PI or important-data export generally enters security assessment, subject to stated exemptions. | Continue to exemptions and volumes. |
| 5 | Does Article 3, 4, 5 or an approved FTZ negative-list regime apply? | Record the exact exemption, facts and evidence; then complete remaining substantive duties. | Calculate cumulative exports since 1 January. |
| 6 | At least 1 million ordinary-PI individuals or at least 10,000 sensitive-PI individuals? | Security assessment. | Continue. |
| 7 | At least 100,000 but below 1 million ordinary-PI individuals, or any sensitive PI below 10,000? | SCC or certification, if all route conditions are met. | Below 100,000 ordinary PI may qualify for Article 5(4) mechanism exemption. |
| 8 | Could the facts change during the calendar year? | Install a count and change-control trigger. | Set a scheduled review anyway. |
Transfer-route legal analysis flowchart
Read top to bottom. A side branch is an outcome only after its stated facts are evidenced.
Test storage, replication, APIs, downloads and remote administrator access.
Ordinary PI · sensitive PI · non-PI · officially identified important data
CII may point to assessment; contract, HR, emergency, imported-data and FTZ facts may change the route.
Ordinary PI: below 100,000 / 100,000–below 1 million / at least 1 million
Sensitive PI: below 10,000 / at least 10,000
Notice/legal basis · separate consent where required · PIPIA · minimisation · recipient controls · filing/certificate/result · change log
If SCC or certification is already in use and the annual count later crosses the assessment threshold, CAC’s January 2026 Q&A says the earlier exports from that year are included in the security-assessment filing scope.
3. Statutory threshold and exemption matrix
| Fact pattern | Preliminary route | Conditions / exclusions | Evidence output | Authority |
|---|---|---|---|---|
| Non-CII; below 100,000 individuals’ ordinary PI since 1 January | Mechanism exemption may apply | No sensitive PI in this volume exemption; important data excluded; test other exemptions/overlays | Count methodology and exemption memo | 2024 Provisions, Arts 5(4), 5 final paragraph |
| Non-CII; 100,000 to below 1 million ordinary PI | SCC or certification | Important data excluded; stated exemptions prevail | SCC filing or certification evidence; PIPIA | 2024 Provisions, Art 8 |
| Non-CII; below 10,000 sensitive-PI individuals | SCC or certification | Important data excluded; stated exemptions prevail | Mechanism file; sensitivity and necessity analysis | 2024 Provisions, Art 8 |
| Non-CII; at least 1 million ordinary-PI individuals | CAC security assessment | Calendar-year cumulative count; stated exemptions prevail | Self-assessment and filing dossier | 2024 Provisions, Art 7(2) |
| Non-CII; at least 10,000 sensitive-PI individuals | CAC security assessment | Calendar-year cumulative count; stated exemptions prevail | Self-assessment and filing dossier | 2024 Provisions, Art 7(2) |
| Important data exported by non-CII processor | CAC security assessment | First determine whether officially notified or published as important | Classification record and dossier | 2024 Provisions, Arts 2, 7(2) |
| CII operator exports PI or important data | CAC security assessment | Stated exemptions may affect result | CII confirmation and dossier | 2024 Provisions, Art 7(1) |
| Contract with individual; cross-border HR; emergency | Mechanism exemption may apply | Transfer must be genuinely necessary; HR route requires lawfully adopted labour rules or collective contract | Necessity/HR/emergency evidence memo | 2024 Provisions, Arts 5(1)–(3) |
Important: the threshold matrix selects among the three outbound mechanisms. Article 10 separately preserves statutory notice, separate-consent and PIPIA duties. CAC’s July 2026 Q&A adds that no consent is needed where a PIPL Article 13(1)(2)–(7) ground applies, while outbound-transfer notice remains required.
4. Annual count calculation
- Thresholds count people, not CRM rows.
- Keep a written annual counting method.
- Below the line, standard contract or certification may still be available.
- Crossing the line later in the year can force a security assessment.
Ordinary PI individuals exported since 1 January + individuals in the proposed transfer not already reflected in the working count = new cumulative annual total.
Decision markers: 100,000 changes the ordinary-PI route; 1,000,000 triggers assessment. Run a separate sensitive-PI count; 10,000 triggers assessment.
Assumptions to record: reporting date; systems and recipients covered; person-level deduplication method; ordinary versus sensitive fields; historic exports from 1 January; forecast population; and any excluded activity. The national rules state the thresholds, but edge-case counting methodology should not be invented. Flag uncertain deduplication, intermittent access or combined datasets for counsel or authority guidance.
Interactive annual transfer-threshold calculator
Enter person-level cumulative counts from 1 January, including the proposed transfer. The tool screens the national mechanism route; it does not decide data classification, CII status, sector overlays, legal basis or whether an exemption is factually available.
The result will identify a preliminary route, remaining duties and facts that can change it.
Calculator assumptions and formula
- Counts are cumulative person-level populations from 1 January and include the proposed transfer.
- Ordinary and sensitive PI are entered separately; do not add them together for the statutory tests.
- Formula: verified historic population + new individuals not already represented = cumulative annual population.
- The tool does not deduplicate data. Record systems, recipients, query date and deduplication method.
- Article 3–6 exemptions, important-data status and CII status are legal/factual inputs, not calculator conclusions.
5. Compare the legal routes
- The trigger is volume and data type, not the vendor’s preferred clause.
- Security assessment usually takes the longest.
- Filing paths differ between CAC assessment and standard-contract filing.
- PIPIA and contracts must match the route you claim.
| Issue | SCC | Certification | Security assessment |
|---|---|---|---|
| Typical use | Qualifying intermediate PI transfers | Qualifying intermediate PI transfers | CII, important data or higher-volume PI |
| CII / important data | Not the route | Not the route | Relevant route |
| Principal external step | Contract with recipient and filing | Assessment by qualified certification institution | Provincial channel to national CAC assessment |
| Core internal work | Data map, PIPIA, notice/basis, contract controls | Data map, PIPIA, notice/basis, certifiable controls | Self-assessment, legal document and dossier |
| Current validity | Monitor contract, filing and changed facts | 3-year certificate; reapply 6 months before expiry | 3-year result; qualifying extension request within 60 working days before expiry |
| Failure signal | Filed scope differs from actual flow | Actual flow differs from certified scope | Purpose, parties, scope, volume or risk changes |
6. Procedural timelines
Security-assessment sequence
- Screen: confirm trigger, important-data status, CII status, exemptions and annual volume.
- Prepare: complete the self-assessment, legal document with overseas recipient and filing materials under the current guide.
- Submit: use the provincial CAC channel; the third-edition guide also identifies the online filing system.
- Assess and respond: track requests, decision and approved scope.
- Operate: constrain the activity to the result and maintain a change log.
- Renew or refile: the result lasts 3 years. If extension conditions are met, apply within 60 working days before expiry; otherwise assess whether a new filing is required.
SCC and certification sequence
Map → count → PIPIA → notice/legal basis → choose route → sign SCC and file, or apply to a qualified certifier → operate within scope → monitor threshold and factual changes. Certification certificates are valid for 3 years; a continuing user applies 6 months before expiry. Crossing the assessment threshold during the year activates the transition rule above.
Personal-information compliance audit sequence
Trigger → scope → auditor/evidence → findings → remediation → report → recurrence. A processor handling more than 10 million individuals’ PI must audit at least once every 2 years. A regulator may require an external audit for specified risks or incidents. For a regulator-required audit, submit the audit report and, after completing remediation, submit the remediation report within 15 working days.
7. Annotated evidence and document structures
PIPIA structure
| Section | What it must establish | Evidence |
|---|---|---|
| Activity and purpose | Exact flow and a clear, reasonable, directly related purpose | Data-flow map and business request |
| Data and people | Categories, sensitivity, minimum scope and current-year count | Inventory and reproducible query/report |
| Recipient | Entity, location, role, onward transfers and rights channel | Due-diligence and recipient file |
| Necessity and proportionality | Why the overseas access and each field are needed | Alternatives/minimisation analysis |
| Risk and controls | Leakage, misuse, loss, onward-transfer and foreign-law risk | Contractual, technical and organisational controls |
| Conclusion | Route, duties, owner, deadline and unresolved assumptions | Approval memo and change triggers |
Scenario evidence packs
| Scenario | Evidence pack | Owner | Refresh trigger |
|---|---|---|---|
| Global HRIS / recruitment | Labour rule or collective contract, decision map, necessity, minimum fields, notice/basis, recipient controls, PIPIA | HR + legal/privacy | New platform, field, recipient or decision process |
| CRM / marketing | Data dictionary, notices, recipient/vendor list, SDK map, annual count, contract and PIPIA | Marketing + privacy | New vendor, campaign or SDK |
| Cloud / SaaS | Architecture, administrator access, subprocessors, logs, encryption, route memo and PIPIA | IT/security + privacy | Architecture or support-location change |
| M&A | Data-room matrix, redaction protocol, access list, classification screen and purpose limits | Deal team + legal | Bidder, adviser or access scope changes |
| Incident | Chronology, affected data/people, containment, notification analysis and evidence log | Security + legal | Each incident and material new fact |
8. Practical workflow: Map → Classify → Route → Evidence → Operate & Monitor
| Stage | Question | Mandatory output |
|---|---|---|
| Map | What actually happens, including remote access? | Data-flow map |
| Classify | What is the data/activity legally? | Classification and important-data screening record |
| Route | Which exemption or mechanism applies? | Decision memo and calculation |
| Evidence | Can every assumption and duty be proved? | PIPIA and evidence pack |
| Operate & Monitor | What change invalidates the conclusion? | Control owner, annual count and change log |
9. Scope and legal hierarchy
Laws — PIPL / Data Security Law / Cybersecurity Law
↓
Administrative regulations — Network Data Security Management Regulations (effective 1 January 2025)
↓
Departmental rules — Data Export Security Assessment Measures / SCC Measures / Personal Information Export Certification Measures
↓
Implementation provisions — 2024 Provisions on Promoting and Regulating Cross-Border Data Flows
↓
Procedural guidance — CAC filing guides and official Q&As
↓
Sector and local overlays — sector catalogues, regulator requirements and approved FTZ negative lists.
The controlling layer depends on the decision. A filing guide explains procedure but does not override a law or regulation. Sector and local overlays must be screened alongside the national baseline.
Legal authority and decision-control diagram
This diagram prevents a common reasoning error: treating procedural guidance, sector practice and binding national law as interchangeable.
How to apply it: identify the proposition → locate the highest controlling authority → check later/specific rules → apply sector/local facts → use guidance for procedure → record any editorial inference separately.
10. Important Data screen
- Check sector and local important-data catalogues.
- Ask whether compromise would affect security or public interest.
- If the answer may be yes, do not default to a standard contract.
- If the answer is no, write down why.
| Result | Question | Action |
|---|---|---|
| Confirmed designation | Has an authority notified the processor or publicly identified the data? | Apply the relevant important-data controls and assessment route. |
| Potential signal | Does a relevant sector/local catalogue or classification rule describe the dataset? | Map the provision to the fields and obtain targeted advice. |
| Escalation signal | Are facts insufficient but consequences material? | Record uncertainty; seek counsel/regulator confirmation before export. |
Do not label all business data “important” and do not ignore the issue. Article 2 of the 2024 Provisions supplies the disciplined middle position: identify and file as required, but do not treat data as important for filing merely because of unsupported speculation where it has not been notified or publicly identified.
11. Action checklist and risk matrix
Use Green (supported), Amber (fact dependent), Red (route/blocker), or Grey (evidence missing).
| Test | Evidence | Owner | Escalation / due point |
|---|---|---|---|
| All transfers and remote access mapped | Architecture and access map | IT | Before design approval |
| PI, sensitive PI and important-data screen complete | Inventory and classification record | Privacy/legal | Before route selection |
| CII, sector and FTZ status checked | Corporate/legal confirmation | Legal | Before route selection; annual review |
| Annual ordinary/sensitive PI counts reproducible | Query, assumptions and forecast | Privacy/data owner | Before go-live; threshold alerts |
| Exemption conditions proved | Necessity, contract/HR/emergency memo | Business + legal | Before relying on exemption |
| PIPIA, notice and legal basis complete | Approved PIPIA and notice/consent record | Privacy | Before transfer |
| Mechanism and filing/certification complete | Dossier, receipt, certificate or result | Legal/privacy | Before applicable transfer |
| Actual activity matches scope | Logs, recipient list and change control | IT + privacy | Continuous; renew/refile trigger |
| Audit trigger and cadence recorded | Population count and audit calendar | Privacy/audit | Annual governance review |
12. Common mistakes and corrective evidence
| Failure | Why it fails | Corrective evidence |
|---|---|---|
| “Below 100,000 means PIPL does not apply.” | Mechanism exemption is not a substantive-law exemption. | Separate route memo from notice, basis, PIPIA, security and rights checklist. |
| Counting only one recipient or system | It can understate the calendar-year export population. | Central count covering all scoped flows and documented assumptions. |
| Treating the HR exemption as automatic | Lawfully adopted rules/collective contract and genuine necessity matter. | HR legal-basis and field-level necessity memo. |
| Ignoring overseas administrator access | Remote availability may be an outbound provision on the facts. | Identity, location, purpose and access-path map. |
| Calling all industrial data “important” | It confuses confirmed rules with speculation. | Confirmed / potential / escalate classification record. |
| Filing once and forgetting | Purpose, parties, data, volume and controls drift. | Change-control log, count alert and renewal calendar. |
13. What changed: 2024–2026
| Date | Change | Operational impact |
|---|---|---|
| 22 Mar 2024 | Cross-Border Data Flow Provisions took effect | Current national exemptions, thresholds and 3-year assessment validity framework |
| 1 Jan 2025 | Network Data Security Management Regulations took effect | Active administrative-regulation layer for network data processing |
| 1 May 2025 | PI Protection Compliance Audit Measures took effect | Audit triggers, cadence, evidence and remediation reporting |
| 27 Jun 2025 | Third-edition security-assessment filing guide issued | Simplified/updated materials and extension procedure |
| 1 Jan 2026 | PI Export Certification Measures took effect | Formal certification scope, 3-year certificate and 6-month renewal lead |
| 30 Jan 2026 | CAC route-transition Q&A | Explains treatment when annual volumes cross the assessment threshold |
| 24 Jul 2026 | CAC notice/consent, extension and recruitment Q&A | Clarifies Article 13 grounds, extension conditions and recruitment necessity |
14. FAQ decision index
The detailed conditional answers are collected in the FAQ accordion below. Use this index to identify the legal test behind each question rather than treating the answer as a universal rule.
| Business question | Controlling factual test | Evidence to review |
|---|---|---|
| Can employee or applicant data enter a global HRIS? | Overseas necessity, Article 5(2) HR conditions, data classification and volume | Labour rules/collective contract, decision map, minimum fields and PIPIA |
| Does the below-100,000 category solve the issue? | Non-CII status, ordinary PI only, annual cumulative population and no important data | Count methodology, classification and separate substantive-PIPL checklist |
| Does overseas administrator access count? | Whether mainland-China data becomes accessible abroad on the actual architecture | Identity, location, permissions, logs, purpose and access-path map |
| SCC or certification? | Eligibility plus contractual, governance and certification-operating fit | PIPIA, recipient controls, filing/certification scope and change process |
| How are thresholds counted or crossed later? | Separate calendar-year ordinary/sensitive populations and transition timing | Reproducible person-level count, deduplication assumptions and forecast |
| Is the dataset important data? | Official notification or published national, sector or local identification | Catalogue mapping and recorded escalation where classification remains uncertain |
| Does an exemption remove notice or PIPIA? | Mechanism selection versus separate PIPL substantive duties | Legal-basis, notice/consent, PIPIA, minimisation and security records |
| Is a compliance audit due? | Population, elapsed audit period and regulator/incident trigger | Population record, audit calendar, findings and remediation log |
15. Source cards and evidence standard
Editorial labels: Binding rule requires the current primary text and provision; Official implementation position requires a government guide or Q&A; Practice observation must identify its source/date; Editorial inference must be stated as an inference. This guide uses no borrowed infographic or unsourced enforcement chart.
| Rule / status | Precise authority | Qualification |
|---|---|---|
| Thresholds, exemptions and assessment validity — CLEAR RULE | 2024 Provisions, Arts 2–10 | Read exemptions and substantive duties separately |
| Mid-year threshold transition — OFFICIAL POSITION | CAC Q&A, 30 Jan 2026, Q1 | Earlier annual exports enter assessment scope |
| Notice/consent, extension and recruitment — OFFICIAL POSITION | CAC Q&A, 24 Jul 2026, Q1–Q3 | Fact-dependent necessity and Article 13 grounds |
| Security-assessment filing — CURRENT PROCEDURE | CAC Filing Guide (3rd ed.), 27 Jun 2025 | Use current forms and filing channel |
| Compliance audits — CLEAR RULE | Audit Measures, Arts 4–12 | Distinguish periodic and regulator-required audits |
| Export certification — CLEAR RULE | Certification Measures, Arts 5–10 | Effective 1 Jan 2026; scope must match actual flow |
| Network-data regulation — CLEAR RULE | Network Data Security Management Regulations | Effective 1 Jan 2025 |
Last primary-source check: 12 August 2026. This is a screening and evidence-design guide, not legal advice. Confirm current texts, sector rules and local practice before acting.
16. Related tools and counsel
- Cross-border transfer roadmap · Export path decision tree · SCC filing timeline
- PIPL key rules · PIPL checklist · Regulatory tracker
- MNC HR/CRM hub · Employee data transfers
City guides
Compare local considerations and counsel:
Find data privacy and cybersecurity lawyers or request a consultation. Frame the request around the unresolved fact: CII status, important-data classification, exemption necessity, route choice, PIPIA, filing or incident response.
