China SCC vs Certification vs CAC Security Assessment
PIPL Art. 38 lists lawful outbound mechanisms. The 2024 CAC Provisions then decide which of those mechanisms you are allowed to use given CIIO status, important data, PI volume and SPI volume. Certification is not a free substitute for the standard contract, and neither is a substitute for security assessment when Art. 6–8 point there. For cost/timing colour on SCC filing see the companion SCC timeline/cost page — this page is the eligibility comparison.
One task: Compare three statutory routes after exemptions and counts — do not shop them as products. · Pillar:China cross-border data-transfer decision guide · Legally reviewed on 8 August 2026 · Law and official guidance checked through 15 August 2026. Editorial orientation — not a determination.
Use potential, possible, may require. Never “compliant”, “approved” or “definitely exempt”.
Direct answer
Comparison
Question
Standard contract
Certification
Security assessment
When potentially available?
Non-CIIO, in the SCC/cert band, no important-data force-up
Same band; programme must actually fit
CIIO, important data, 1m+ PI or 10k+ SPI (2024 text)
General information only. Confirm the instrument version that applies to your facts.
Source register · primary authorities and verification
Sources & trust
How to use this guide
Primary sources for this page (editorial source-check 2026-09-19): PRC Personal Information Protection Law (PIPL). Confirm current rules with qualified counsel. This page is not legal advice. Official primary-source links already on this page: Official original — https://www.court.gov.cn/xinshidai/xiangqing/318421.html; Official original — https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm.
Editorial, AI and verification policies
This page is general information for orientation. It is not legal advice and does not create an attorney–client relationship.
Legal boundary: Prefer primary statutes, judicial interpretations, and official guidance when making decisions. Where this guide links to city hubs or lawyer listings, verify credentials and engagement terms directly with counsel. Full disclaimer · Submit an initial enquiry.
FAQ
Common questions
Quick answers for foreign nationals and employers. Rules vary by city and change over time.
Can we certify instead of signing a China SCC because the group already has EU BCRs?
EU BCRs / EU SCCs do not pick the PRC route. Recheck Art. 6–8 on PRC facts.
Consultation preparation
Before contacting counsel
First package for a conflict check
A concise timeline and the result you want to achieve.
Names of all parties and affiliates for a conflict check.
Key contracts, notices, correspondence, filings, or decisions.
Known deadlines, preferred language, location, and budget constraints.
Topic counsel
Counsel shortlist for this guide
Profiles matched by practice to this topic. A shortlist for consultation — not an endorsement of any filing, clearance or legal outcome.
Practice-matchedVerified status shown per profileFree initial consultation
Use International Lawyers for host-country counsel. Use Find Counsel when a PRC workstream (ODI, SAFE, onshore entities, mainland contracts) still sits beside the destination matter.
Status shown per profileFree initial intakeDestination + PRC routing
