Personal information must not be casually transferred overseas; legal conditions and thresholds apply

10. Personal information must not be casually transferred overseas; legal conditions and thresholds apply

Cost: No cost involved. The simplest solution is to keep user data within China. If transfer overseas is unavoidable, follow standard contracts or obtain proper certification.

In plain terms: Transferring personal information of Chinese users to servers abroad constitutes a cross-border data transfer. Simply hosting servers overseas does not mean the data stays within China. There are four approved pathways for such transfers: a security assessment by the Cyberspace Administration, certification by authorized agencies, signing a standard contract, or compliance with other legal provisions. You must also disclose to users who receives their data, what it will be used for, and obtain their explicit consent for this specific purpose.

Benefit: To lawfully provide personal information to overseas entities — whether to foreign companies or foreign servers — at least one of four conditions must be met: passing a security assessment by the Cyberspace Administration; obtaining personal information protection certification; signing a standard contract drafted by the Cyberspace Administration; or meeting other requirements set by laws or administrative regulations. Additionally, you must inform users of the overseas recipient’s name, contact details, processing purpose, methods, and types of data involved, and obtain their separate consent. Threshold limits apply based on cumulative user counts. For most businesses not classified as critical information infrastructure operators, the exemption threshold is “fewer than 100,000 personal records (excluding sensitive information) transferred overseas in a calendar year.” Below this threshold, no assessment, contract, or certification is required. Between 100,000 and 1,000,000 records, a standard contract or certification is mandatory. For over 1,000,000 records, or when sensitive information of more than 10,000 individuals is involved, a formal security assessment is required (effective nationwide since March 2024).

Evidence grade: A

Notes: Hosting servers overseas does not equate to “data never leaving China.” If a user registers within China and their data is sent to foreign servers, this is still a cross-border transfer. Certain scenarios are exempt from assessment, certification, or standard contracts: cross-border shopping, shipping, or booking flights/hotels, provided these actions are necessary to fulfill a contract involving the user. Note also that user counts are calculated on a cumulative basis starting from January 1 of each year, not as a rolling 12-month period.

Sources: Standing Committee of the National People's Congress (2021). Personal Information Protection Law (Articles 38, 39, and 40). <https://www.spp.gov.cn/spp/fl/202108/t20210820_527244.shtml>; Cyberspace Administration of China (2024). Regulations on Promoting and Regulating Cross-Border Flows of Data (Cyberspace Administration Order No. 16, Third, Articles 4, 5, 7, and 8). <https://www.gov.cn/gongbao/2024/issue_11366/202405/content_6954192.html>; Cyberspace Administration of China (2022). Data export security assessment methods (Cyberspace Administration Order No. 11, Article 4). <https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm>