Cross-Border Data Transfer Security Evaluation in China

1. Introduction

Cross-border data transfer security evaluation in China refers to the legal and regulatory mechanisms used to assess the risks associated with transferring data from China to recipients located outside its territory. These transfers arise in international business operations, cloud computing, financial services, healthcare, scientific research, multinational employment, and digital commerce.

China regulates cross-border data transfers to protect personal information, safeguard important data, preserve national security, and ensure that overseas recipients handle data in accordance with applicable legal requirements.

The principal legal framework includes the Cybersecurity Law of the People's Republic of China (CSL), the Data Security Law (DSL), and the Personal Information Protection Law (PIPL). Additional rules issued by the Cyberspace Administration of China (CAC) establish procedures for security assessments, standard contractual arrangements, and personal information protection certification.

The framework is not an absolute prohibition on international data transfers. Instead, it establishes different compliance requirements depending on the nature and volume of the data, the identity of the transferring organisation, and the risks associated with the proposed transfer.

Failure to comply may result in regulatory investigations, corrective orders, administrative penalties, suspension of data-transfer activities, and, where the legal requirements are satisfied, criminal liability.

2. Meaning and Scope of Security Evaluation

A cross-border data transfer security evaluation examines whether data can be transferred overseas without creating unacceptable risks to national security, public interests, or the rights and interests of individuals.

The evaluation may consider:

The type, volume, and sensitivity of the data being transferred.

The purpose and necessity of the transfer.

The identity and reliability of the overseas recipient.

The recipient's technical and organisational security measures.

The possibility of unauthorised access, disclosure, alteration, or misuse.

The laws and regulatory environment applicable to the overseas recipient.

The measures available to protect individuals' rights after transfer.

For example, a Chinese healthcare company transferring identifiable patient records to an overseas research institution may need to assess the sensitivity of the information, obtain the required legal basis and permissions, and determine which cross-border transfer mechanism applies.

By contrast, an ordinary international commercial transfer involving no personal information or important data may qualify for an exemption under the applicable rules.

The legal classification of the information is therefore essential before a transfer takes place.

3. Principal Legal Framework

A. Personal Information Protection Law, 2021

The Personal Information Protection Law is one of China's principal data-protection statutes.

Articles 38–40 establish important requirements for providing personal information to overseas recipients.

Article 38 identifies mechanisms for lawful cross-border provision of personal information, including:

Passing a CAC-organised data-transfer security assessment.

Obtaining personal information protection certification.

Entering into the prescribed standard contract with the overseas recipient.

Satisfying other applicable conditions established by law or regulation.

Article 39 generally requires the personal information processor to inform the individuals concerned about the overseas recipient, the purposes and methods of processing, the categories of information involved, and the procedures for exercising their rights. It also requires separate consent where applicable.

Article 40 establishes domestic storage and security-assessment requirements for critical information infrastructure operators and certain personal information processors meeting prescribed thresholds.

The PIPL also contains provisions concerning unlawful processing, regulatory enforcement, and legal liability.

B. Data Security Law, 2021

The Data Security Law establishes a framework for classifying and protecting data according to its importance and the risks associated with its processing.

The law is particularly relevant to the protection of important data and information that may affect national security, economic operations, public interests, or other protected interests.

Organisations must identify and protect relevant data categories and comply with applicable requirements governing overseas transfers.

A transfer involving important data may require a security assessment even when the information does not identify a natural person.

C. Cybersecurity Law, 2017

China's Cybersecurity Law provides additional requirements concerning network security and the protection of personal information and other important data.

Article 37 establishes localisation and security-assessment requirements for certain personal information and important data collected or generated by critical information infrastructure operators during operations within mainland China.

Its application must be assessed alongside the PIPL, the Data Security Law, subsequent implementing rules, and amendments applicable at the time of the transfer.

D. Measures on Security Assessment of Data Exports, 2022

The CAC issued the Measures on Security Assessment of Data Exports in 2022. These measures established procedures for determining when a formal government security assessment is required.

The framework was subsequently adjusted by the Provisions on Promoting and Regulating Cross-Border Data Flows, issued on 22 March 2024.

The 2024 Provisions clarify exemptions and revise the thresholds governing mandatory assessments and alternative transfer mechanisms. Accordingly, compliance decisions should be based on the revised framework rather than the original 2022 thresholds alone.

4. Current Cross-Border Transfer Mechanisms

Under the 2024 Provisions, the principal mechanisms include government security assessment, standard contracts, and personal information protection certification.

A. Mandatory Security Assessment

A formal security assessment is generally required in the following circumstances, subject to applicable exemptions:

A critical information infrastructure operator provides personal information or important data overseas.

A non-critical-infrastructure data processor transfers important data overseas.

A non-critical-infrastructure data processor transfers personal information concerning at least one million individuals overseas in the current calendar year, excluding sensitive personal information.

A non-critical-infrastructure data processor transfers sensitive personal information concerning at least 10,000 individuals overseas in the current calendar year.

The classification of important data, the calculation of transfer volumes, and the availability of exemptions must be assessed under the applicable rules.

B. Standard Contract or Certification

For non-critical-infrastructure operators, a standard contract or personal information protection certification is generally required where annual outbound transfers reach:

At least 100,000 but fewer than one million individuals' personal information, excluding sensitive personal information; or

Fewer than 10,000 individuals' sensitive personal information.

These requirements are subject to the exemptions and other conditions specified in the 2024 Provisions.

The standard-contract mechanism is governed by the Measures on the Standard Contract for Cross-Border Transfer of Personal Information, which took effect on 1 June 2023. A qualifying organisation must generally complete a personal information protection impact assessment, execute the prescribed contract, and file the required materials with the competent provincial cyberspace administration within 10 working days after the contract becomes effective.

C. Exemptions

Certain transfers may be exempt from the security-assessment, standard-contract, and certification requirements.

Examples include:

Transfers of data generated in international trade, transportation, academic cooperation, manufacturing, or marketing activities, where the data contains neither personal information nor important data.

Transfers necessary to perform a contract to which the individual is a party, such as certain cross-border payments, travel bookings, or delivery services.

Necessary transfers of employee personal information for qualifying cross-border human-resources management.

Necessary transfers in emergencies to protect individuals' life, health, or property.

Certain limited transfers by non-critical-infrastructure operators.

Exemption from these transfer mechanisms does not necessarily eliminate other obligations under Chinese law, including applicable notice, consent, security, and data-handling requirements.

5. Important Case Laws and Regulatory Precedents

China's cross-border data-transfer framework is relatively recent. Published judicial decisions directly interpreting the CAC's security-assessment thresholds and procedures remain limited. Consequently, related cybersecurity and personal-information cases are important for understanding the principles that courts and regulators apply.

A. Didi Global Cybersecurity Investigation, 2022

Authority: Cyberspace Administration of China.

In July 2022, Chinese authorities announced penalties against Didi Global following a cybersecurity investigation.

The CAC imposed a fine of RMB 8.026 billion and imposed a separate personal fine on Didi's chairman and chief executive. The authority identified multiple violations involving cybersecurity, data security, and personal information protection.

The investigation highlighted the regulatory significance of data governance at a major platform operating across national boundaries.

Legal significance: The Didi matter demonstrates that large technology companies may face substantial consequences when their data practices violate Chinese cybersecurity and personal-information requirements.

However, it should not be characterised simply as a judicial ruling that every cross-border transfer requires prior security approval. The penalties arose from a broader regulatory investigation, and the matter was an administrative enforcement action rather than an ordinary court judgment.

B. Beijing Weibo Internet Technology Co. Ltd. Personal Information Case, 2021

Authority: Beijing Internet Court.

In a dispute concerning the processing of personal information by a major online platform, the Beijing Internet Court examined issues relating to the collection and handling of users' personal information and the protection of individual rights.

The case forms part of the broader Chinese judicial development of personal-information protection principles.

Legal significance: The reasoning is relevant to the assessment of whether personal information is collected and processed lawfully and whether organisations respect individuals' legal rights.

For cross-border transfers, such principles support the need to identify the legal basis for processing and to protect individuals whose information is disclosed to overseas recipients.

This case should not be treated as a direct precedent establishing the CAC's current outbound-transfer thresholds.

C. Hangzhou Internet Court and Personal Information Protection Litigation

Court: Hangzhou Internet Court.

Chinese internet courts have addressed disputes involving the collection, use, and disclosure of personal information by digital platforms. Such proceedings have contributed to the interpretation of personal-information rights and the obligations of organisations handling digital records.

Legal significance: These cases are relevant to the general principles of lawful data processing, transparency, and the protection of individuals against improper information handling.

Their relevance to cross-border transfers is indirect unless a particular judgment specifically addresses an overseas disclosure or the application of a cross-border transfer requirement.

For a legal submission, the exact case title, judgment date, case number, and holding should be verified before citing a particular internet-court decision as authority.

D. Administrative Enforcement Under the Personal Information Protection Law

Chinese authorities have also investigated and penalised organisations for alleged or established violations involving unlawful personal-information processing, excessive collection, and deficient data protection.

Such enforcement actions demonstrate the practical importance of maintaining records of data flows, establishing legal grounds for processing, and implementing effective technical and organisational safeguards.

Legal significance: Administrative enforcement can be particularly important in cross-border compliance because a regulator may examine the organisation's overall data practices, not merely the existence of a transfer contract.

Nevertheless, an enforcement action concerning unlawful collection or inadequate security should not be presented as a direct ruling on the legal validity of a particular overseas transfer unless the published decision establishes that point.

6. Corporate Liability and Compliance Obligations

Companies transferring data from China should adopt a structured compliance programme.

First, they should map the data collected and generated within mainland China and identify whether it includes personal information, sensitive personal information, or important data.

Second, they should determine whether they qualify as critical information infrastructure operators and calculate relevant annual transfer volumes.

Third, they should select the applicable transfer mechanism and document the legal basis for using it.

Fourth, they should evaluate the overseas recipient's security measures, access controls, retention policies, and ability to respond to security incidents.

Fifth, they should maintain records demonstrating compliance with assessment, contractual, certification, notice, consent, and reporting requirements.

Where a company knowingly circumvents mandatory procedures, conceals unlawful transfers, or falsifies compliance records, it may face regulatory penalties and, where the elements of a criminal offence are established, criminal prosecution.

Corporate officers are not automatically criminally liable merely because they hold managerial positions. Individual liability depends on the applicable legal provisions and evidence of their own legally relevant conduct.

7. Consequences of Non-Compliance

Depending on the applicable legislation and the seriousness of the violation, consequences may include:

Orders to correct unlawful data-processing practices.

Suspension or termination of particular data-transfer activities.

Administrative fines.

Restrictions on relevant business activities.

Liability for harm caused to affected individuals.

Criminal prosecution where the conduct satisfies the requirements of an applicable offence.

Under the PIPL, serious violations can result in substantial administrative fines and other sanctions. The applicable penalty depends on the nature of the violation, its seriousness, and the statutory provisions governing the conduct.

8. Conclusion

Cross-border data transfer security evaluation in China represents a significant component of the country's cybersecurity and data-protection framework. Its principal objectives are to protect personal information, safeguard important data, and manage national-security and public-interest risks while permitting lawful international data flows.

The PIPL, Data Security Law, Cybersecurity Law, and the CAC's 2022 and 2024 measures collectively establish the principal legal framework. Organisations must determine whether a government security assessment, standard contract, certification, or exemption applies before proceeding with a transfer.

The Didi enforcement matter illustrates the seriousness with which Chinese authorities approach data governance, while Chinese personal-information litigation provides broader guidance on lawful processing and individual rights.

Ultimately, effective compliance requires accurate data classification, appropriate transfer mechanisms, documented risk assessments, strong technical safeguards, and continuing oversight of overseas recipients. The applicable requirements must be evaluated against the precise facts and the rules in force at the time of transfer.