When an assessment is the plausible mandatory path.
Skip to guide content
CACSecurity assessment SCCStandard contract CertCertification TestExemption / threshold
Transfers · 03 Editorial guide
Cross-Border Data Transfers and Foreign AI Providers into China
A transfer path is a gate. Architecture slides are not a filing.
First job Name the transfer route before promising a system architecture or a date.
Decision railChina-facing? → operator → telecom/cloud → AI filing → data export gate → launch
See routing factsDo not promise a cutover before the export gate is named
Open the transfer roadmapA missed CAC or SCC step can move the date. This is a compliance clock, not a safety strip.
Start here
Key considerations
The first questions are about urgency, governance and preservation — before collection expands or interviews begin.
- What leaves China, and to whom?
- Which mechanism is even plausible?
- What clock sits in front of go-live?
Direct answer
What this page decides
Owner
02
02
This page owns PIPL export gates and AI05 routing: if a foreign model or API is China-facing, ask (1) is there a China operator, (2) telecom/cloud, (3) algorithm/genAI filing, (4) data export, (5) launch. Do not invent SCC thresholds. FDI sector L4 owns VATS/ICP access.
At a glance
Which fact changes the next route
Use the fact that changes ownership or urgency to decide the next move.
| Question | Why it matters | Next route |
|---|---|---|
| Only HR data to HQ? | Classic transfer file. | This L4’s existing transfer routes. |
| Offshore LLM, China users? | AI05. | Rail above + FDI sector. |
Scope
What this page owns — and what it does not
Transfers + AI05.
ExclusionsNSR (FDI); export-controls of models as dual-use (export-control centre).
Practical workflow
Action, evidence, legal gate, output
| Action | Documents / evidence | Legal gate | Output |
|---|---|---|---|
| Is it a China-facing service? | Users, language, payment, servers | If no, still may export PI of employees | Facing memo |
| Name the China operator | WFOE vs none | FDI/telecom if providing | Operator |
| Pick the export mechanism | Current CAC paths | No memorised volume numbers | Gate |
| AI filing overlay | Programme L4 | If public genAI/recommender | Filing owner |
Documents
What to gather before the next call
These items help clarify the file; they are not a legal requirement list.
| Item | Why needed | Who holds it | Risk if missing |
|---|---|---|---|
| Data map and vendor locations | Export | IT | Silent US tenant |
| Product geography | AI05 | Product | Unlicensed China offering |
Common failure points
Where files usually break
Pointing China users at a US API and calling it ‘SaaS’ with no transfer or telecom analysis.
FAQ
Narrow follow-ups owned by this page
Does an SCC replace algorithm filing?
No. Different regimes. Sequence them.
Decision map
Keep the question bounded.
- Describe the flowCategories, volume band and overseas recipient type.
- Pick a candidate pathAssessment, SCC, certification or exemption test.
- Place it on a clockDo not promise a cutover before the gate is named.
Timeline
Sequence and clocks that change the next action.
- Before architecture lockRecipient and volume facts that change the path.
- Before go-liveFiling or contract steps that must exist.
- After go-liveOngoing records and change control.
Regulatory gates
Approvals that can hold signing or closing.
This map does not decide whether a filing is required on your facts.
When the working mechanism is a China standard-contract filing for this transfer, not a generic export slogan.
When certification is in view.
When a published test may change the path — still a test.
Quick answers
Need the short version? Start with one narrow question.
These explainers answer one question. They do not replace this topic route or a deep guide.
Quick AnswerCross-Border Data Transfer in China: Paths and BasicsChina cross-border data transfer basics: CAC security assessment, standard contracts (SCC), certification, and when each path applies for foreign companies.Quick AnswerChina Standard Contract for Personal Information ExportThe CAC standard contract (SCC) is one PIPL export tool: fill the official template, file it, and do not treat it as a GDPR SCC clone. Thresholds change. Reviewed 6 Sep 2026.Quick AnswerCAC Security Assessment for Data ExportA CAC security assessment is the regulator-facing export gate for CII, important data and volume/trigger cases. It is not an SCC filing. Thresholds change. Reviewed 6 Sep 2026.Quick AnswerPersonal Information Protection Certification in ChinaPIPL certification is the third CBDT tool: a designated body certifies the handler/group processing. It is not ISO 27001 and not an SCC. Reviewed 6 Sep 2026.
Curated resources
Open the asset that matches this job.
01
Guide
02China data compliance decision guide
National PIPL, transfer and cybersecurity decision desk — not a substitute for a filing pack.
Guide
03Cross-border data transfer roadmap
Compare export mechanisms and the clocks that sit in front of go-live.
Guide
HR and CRM cross-border architecture
Group HR and CRM systems as a typical transfer pattern, not a clearance.
Helpful to prepare
Facts that make the next conversation clearer.
These items are orientation aids, not a legal requirement list.
Overseas recipients and system names at a high levelCandidate mechanismTarget go-live or HR/payroll date
Counsel hand-off
What to bring when you instruct
Instruct data counsel plus FDI if you are providing a service into China. Bring: architecture diagram and user geography.
Local context
Add the city when regulator practice changes.
CAC and industry-regulator practice can differ after the national transfer or cybersecurity question is identified.
Open city and province guidesCounsel hand-off
Need data-privacy counsel?
This hub organises PIPL, cybersecurity and export questions. It does not decide whether a transfer is lawful or whether notice is required on your facts.
Find data-privacy counselLegal review
Who reviewed this guide
Need qualified counsel?
Move carefully. Move with a record.
Use the portal to identify counsel for this practice and related China-side issues.