Direct answer: start with the facts, not the name of a statute. If mainland-China data is accessible abroad, screen for personal information, sensitive personal information and important data; then test the exemptions and thresholds below. A mechanism exemption does not remove the PIPL duties that still apply. The working output should be a decision memo, evidence pack, next deadline and a short list of unresolved facts for China counsel.
1. What must a foreign business decide?
Determine what actually crosses the mainland-China boundary, classify it, identify the people and systems involved, calculate cumulative individuals from 1 January, and test important-data, CII, sector and FTZ rules before choosing a route. Do not treat an exemption from security assessment, SCC and certification as an exemption from PIPL notice, necessity, impact-assessment, security or rights obligations.
| Input fact | Decision | Required output | Escalate when |
|---|---|---|---|
| Remote access, API, replication or file transfer | Is data made available outside mainland China? | Data-flow and access map | Architecture or recipient location is unclear |
| Fields, purpose and affected people | PI, sensitive PI, non-PI or potential important data? | Classification record | Sector catalogue or data status is uncertain |
| CII status, annual counts and scenario | Assessment, SCC, certification or mechanism exemption? | Route memo and calculation | A threshold, exemption condition or CII status is uncertain |
| Notice, legal basis, necessity and controls | What substantive PIPL duties remain? | PIPIA, notice/consent record and control evidence | Necessity or legal basis is contested |
| Changes to data, recipient, purpose or volume | Does the conclusion, filing or approval remain valid? | Change log and review date | Actual activity drifts from the approved scope |
2. China Data Route Engine
- Security assessment is the high-volume or important-data path.
- The standard contract is the common intra-group path when thresholds allow it.
- Certification is an alternative group mechanism, not a shortcut around facts.
- An exemption can remove a mechanism but not notice, consent or PIPIA where they still apply.
Use this as a screening tree, not an automated legal opinion. A “yes” or “no” must be supported by the evidence shown in the right-hand column.
| Step | Question | If yes | If no / evidence |
|---|---|---|---|
| 1 | Will data collected or generated in mainland China be accessible outside mainland China? | Continue to classification. | Document the architecture and access controls; apply domestic duties. |
| 2 | Does it contain PI, sensitive PI or data officially identified as important? | Separate each category and count PI. | For non-PI/non-important data generated in listed international activities, test Article 3. |
| 3 | Has the data been notified or publicly identified as important data? | Security-assessment route is relevant. | Article 2 says a processor need not file merely on speculation; still screen sector/local catalogues. |
| 4 | Is the exporter a CII operator? | PI or important-data export generally enters security assessment, subject to stated exemptions. | Continue to exemptions and volumes. |
| 5 | Does Article 3, 4, 5 or an approved FTZ negative-list regime apply? | Record the exact exemption, facts and evidence; then complete remaining substantive duties. | Calculate cumulative exports since 1 January. |
| 6 | At least 1 million ordinary-PI individuals or at least 10,000 sensitive-PI individuals? | Security assessment. | Continue. |
| 7 | At least 100,000 but below 1 million ordinary-PI individuals, or any sensitive PI below 10,000? | SCC or certification, if all route conditions are met. | Below 100,000 ordinary PI may qualify for Article 5(4) mechanism exemption. |
| 8 | Could the facts change during the calendar year? | Install a count and change-control trigger. | Set a scheduled review anyway. |
Transfer-route legal analysis flowchart
Read top to bottom. A side branch is an outcome only after its stated facts are evidenced.
Test storage, replication, APIs, downloads and remote administrator access.
Ordinary PI · sensitive PI · non-PI · officially identified important data
CII may point to assessment; contract, HR, emergency, imported-data and FTZ facts may change the route.
Ordinary PI: below 100,000 / 100,000–below 1 million / at least 1 million
Sensitive PI: below 10,000 / at least 10,000
Notice/legal basis · separate consent where required · PIPIA · minimisation · recipient controls · filing/certificate/result · change log
If SCC or certification is already in use and the annual count later crosses the assessment threshold, CAC’s January 2026 Q&A says the earlier exports from that year are included in the security-assessment filing scope.
3. Statutory threshold and exemption matrix
| Fact pattern | Preliminary route | Conditions / exclusions | Evidence output | Authority |
|---|---|---|---|---|
| Non-CII; below 100,000 individuals’ ordinary PI since 1 January | Mechanism exemption may apply | No sensitive PI in this volume exemption; important data excluded; test other exemptions/overlays | Count methodology and exemption memo | 2024 Provisions, Arts 5(4), 5 final paragraph |
| Non-CII; 100,000 to below 1 million ordinary PI | SCC or certification | Important data excluded; stated exemptions prevail | SCC filing or certification evidence; PIPIA | 2024 Provisions, Art 8 |
| Non-CII; below 10,000 sensitive-PI individuals | SCC or certification | Important data excluded; stated exemptions prevail | Mechanism file; sensitivity and necessity analysis | 2024 Provisions, Art 8 |
| Non-CII; at least 1 million ordinary-PI individuals | CAC security assessment | Calendar-year cumulative count; stated exemptions prevail | Self-assessment and filing dossier | 2024 Provisions, Art 7(2) |
| Non-CII; at least 10,000 sensitive-PI individuals | CAC security assessment | Calendar-year cumulative count; stated exemptions prevail | Self-assessment and filing dossier | 2024 Provisions, Art 7(2) |
| Important data exported by non-CII processor | CAC security assessment | First determine whether officially notified or published as important | Classification record and dossier | 2024 Provisions, Arts 2, 7(2) |
| CII operator exports PI or important data | CAC security assessment | Stated exemptions may affect result | CII confirmation and dossier | 2024 Provisions, Art 7(1) |
| Contract with individual; cross-border HR; emergency | Mechanism exemption may apply | Transfer must be genuinely necessary; HR route requires lawfully adopted labour rules or collective contract | Necessity/HR/emergency evidence memo | 2024 Provisions, Arts 5(1)–(3) |
Important: the threshold matrix selects among the three outbound mechanisms. Article 10 separately preserves statutory notice, separate-consent and PIPIA duties. CAC’s July 2026 Q&A adds that no consent is needed where a PIPL Article 13(1)(2)–(7) ground applies, while outbound-transfer notice remains required.
4. Annual count calculation
- Thresholds count people, not CRM rows.
- Keep a written annual counting method.
- Below the line, standard contract or certification may still be available.
- Crossing the line later in the year can force a security assessment.
Ordinary PI individuals exported since 1 January + individuals in the proposed transfer not already reflected in the working count = new cumulative annual total.
Decision markers: 100,000 changes the ordinary-PI route; 1,000,000 triggers assessment. Run a separate sensitive-PI count; 10,000 triggers assessment.
Assumptions to record: reporting date; systems and recipients covered; person-level deduplication method; ordinary versus sensitive fields; historic exports from 1 January; forecast population; and any excluded activity. The national rules state the thresholds, but edge-case counting methodology should not be invented. Flag uncertain deduplication, intermittent access or combined datasets for counsel or authority guidance.
Interactive annual transfer-threshold calculator
Enter person-level cumulative counts from 1 January, including the proposed transfer. The tool screens the national mechanism route; it does not decide data classification, CII status, sector overlays, legal basis or whether an exemption is factually available.
The result will identify a preliminary route, remaining duties and facts that can change it.
Calculator assumptions and formula
- Counts are cumulative person-level populations from 1 January and include the proposed transfer.
- Ordinary and sensitive PI are entered separately; do not add them together for the statutory tests.
- Formula: verified historic population + new individuals not already represented = cumulative annual population.
- The tool does not deduplicate data. Record systems, recipients, query date and deduplication method.
- Article 3–6 exemptions, important-data status and CII status are legal/factual inputs, not calculator conclusions.