Provisions on the Standard Contract for Cross-Border Transfer of Personal Information — Full English Translation (2023)

Promulgated by the Cyberspace Administration of China on February 22, 2023

Effective: June 1, 2023

Article 1 — These Provisions are formulated in accordance with the Personal Information Protection Law of the People’s Republic of China, the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, and other relevant laws and regulations, for the purpose of regulating the use of standard contracts for the cross-border transfer of personal information and protecting the rights and interests of personal information subjects.

Article 2 — Where a personal information processor transfers personal information abroad by entering into a standard contract with an overseas recipient, it shall comply with these Provisions.

Article 3 — A personal information processor that simultaneously meets all of the following conditions may transfer personal information abroad by entering into a standard contract with an overseas recipient:

(1) It is not a critical information infrastructure operator;

(2) It processes personal information of fewer than one million individuals;

(3) It has cumulatively transferred personal information of fewer than 100,000 individuals abroad since January 1 of the previous year;

(4) It has cumulatively transferred sensitive personal information of fewer than 10,000 individuals abroad since January 1 of the previous year.

Article 4 — A personal information processor shall not circumvent the requirement to conduct a security assessment of cross-border data transfer under these Provisions by splitting the quantity of personal information or otherwise.

Article 5 — The standard contract for the cross-border transfer of personal information shall be signed in accordance with the standard contract text issued by the Cyberspace Administration of China. The standard contract shall take effect upon the signatures and seals of both parties.

Article 6 — The standard contract shall strictly follow the standard contract text issued by the Cyberspace Administration of China. The contracting parties may agree on other terms that are not in conflict with the standard contract text, provided that such terms shall not conflict with the standard contract text.

Article 7 — Before transferring personal information abroad, the personal information processor shall conduct a personal information protection impact assessment, focusing on the following:

(1) The legality, legitimacy, and necessity of the purpose, scope, and method of processing personal information by the personal information processor and the overseas recipient;

(2) The scale, scope, type, and degree of sensitivity of the personal information to be transferred abroad, and the risks that the cross-border transfer of personal information may pose to personal information rights and interests;

(3) Whether the responsibilities and obligations undertaken by the overseas recipient, and the management, technical measures, and capabilities for performing such responsibilities and obligations, can ensure the security of the personal information to be transferred abroad;

(4) The risk of leakage, damage, tampering, or abuse of personal information after cross-border transfer, and whether individuals have convenient channels for safeguarding their personal information rights and interests;

(5) The impact of personal information protection policies, laws, and regulations of the country or region where the overseas recipient is located on the performance of the standard contract.

Article 8 — Where a personal information processor transfers personal information abroad under a standard contract, it shall file the standard contract and the personal information protection impact assessment report with the cyberspace administration authority at the provincial level where it is located within ten working days from the effective date of the standard contract.

Article 9 — The cyberspace administration authority at the provincial level shall, upon receipt of the filed materials, examine the completeness of the materials. Where the materials are complete, the authority shall accept the filing; where the materials are incomplete, it shall notify the personal information processor to supplement them within a specified time limit.

Article 10 — The cyberspace administration authority shall strengthen its supervision and management of standard contracts for the cross-border transfer of personal information. Where it is found that the standard contract no longer meets the requirements for the cross-border transfer of personal information, the authority shall notify the personal information processor to rectify the situation; where the circumstances are serious, it shall order the termination of the cross-border transfer of personal information.

Article 11 — Where, during the validity period of the standard contract, any of the following circumstances occurs, the personal information processor shall re-conduct a personal information protection impact assessment and re-sign the standard contract and file it accordingly:

(1) There is a change in the purpose, scope, type, degree of sensitivity, method, storage location, or overseas recipient of the personal information transferred abroad, or there is a change in the retention period of personal information by the overseas recipient;

(2) There is a change in the personal information protection policies, laws, and regulations of the country or region where the overseas recipient is located that may affect the rights and interests of personal information subjects;

(3) Other circumstances that may affect the rights and interests of personal information subjects.

Article 12 — These Provisions shall be interpreted by the Cyberspace Administration of China.

Article 13 — These Provisions shall enter into force on June 1, 2023. A six-month grace period shall be provided from the effective date for those personal information processors that have already carried out cross-border transfer of personal information before the effective date.