Personal Information Protection Certification in China

Certification is a CAC-recognised conformity path — not a generic ISO badge.

PIPL allows providing PI abroad after obtaining certification from a professional institution in accordance with CAC provisions. In practice this is used for some intra-group and platform scenarios. The certificate is not a substitute for PIPL duties (notices, SPI, PIA). It is not ISO 27001, not SOC 2, and not EU BCR by another name — though group BCRs can inform the file. Designated certification bodies and scope rules change. If assessment is triggered, certification does not let you skip CAC. Confirm current CAC/SAMR certification catalogues before you sell this path to a board.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

Is certification available for this fact pattern?

Group, platform, current catalogue.

Fit

Is assessment triggered anyway?

Then certification is the wrong lane.

Lane

Which body and scope?

Designated institution, not a random auditor.

Body

What processing is in scope?

Certificate scope vs actual CRM export.

Scope

Working rule: PIPL allows providing PI abroad after obtaining certification from a professional institution in accordance with CAC provisions.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal

Ask the operating question

Why it changes the route

ISO rebadge

Did a vendor sell ‘PIPL certified’ ISO?

Different scheme.

Whole-group myth

Does one certificate cover every affiliate and every new product?

Scope is written on the certificate.

Skip notices

Did legal say certification replaces consent/notice?

It does not.

Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Current certification rulesCAC/SAMR lists and implementing documents.

02Group processing mapWhich entities, systems, PI types.

03Certificate textScope, validity, surveillance audits.

Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Is this common for SMEs?

SCC is still the workhorse for many mid-size exporters. Certification is often a group play.

Does it replace the PIA?

No. You still assess PIPL risks.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

PIPL (NPC / official text)

Cyberspace Administration of China

National laws database (NPC)

Gov.cn policy releases