Promulgated by: Cyberspace Administration of China (CAC).
Issued by CAC on May 30, 2023. Effective the same day.
I. Scope of Application Where a personal information handler provides personal information abroad by concluding a standard contract, all of the following circumstances shall be met concurrently:
(I) It shall not be a critical information infrastructure operator; 100
(II) The number of people whose personal information is processed by it shall be less than one million;
(III) The number of people whose personal information has been provided abroad accumulatively shall be less than 100,000 since January 1 of the previous year; and
(IV) The number of people whose sensitive personal information has been provided abroad accumulatively shall be less than 10,000 since January 1 of the previous year. Where laws, administrative regulations or the Cyberspace Administration of China (“CAC”) stipulates otherwise, such provisions shall prevail. Personal information handlers shall not take such means as quantity splitting to provide overseas personal information that should pass exit security assessment according to law by entering into a Standard Contract. The following circumstances are deemed as acts of outbound transfer of personal information:
(I) where a personal information handler transfers or stores abroad the personal information collected and generated in its domestic operation;
(II) where the personal information collected and generated by a personal information handler is stored domestically but can be inquired, retrieved, downloaded and exported by overseas institutions, organizations or individuals; and
(III) other acts of outbound transfer of personal information as prescribed by the CAC. 10 II . Methods of Filing A personal information handler shall, within ten working days from the effective date of a Standard Contract, file the Standard Contract with the local provincial cyberspace administration for the record by serving written materials attached with the electronic version thereof.
III. Filing Process The filing process for a Standard Contract includes such steps as material submission, inspection and verification of materials, feedback on filing results, supplementation or re-filing, etc. 1
(I) Submission of Materials To file a Standard Contract, a personal information handler shall submit the following materials (see Appendix I for requirements): 1. 1. photocopy of the unified social credit code certificate; 2. 2. photocopy of the identity document of the legal representative; 3. 3. photocopy of the identity document of the handling person; 4. 2 4. power of attorney to the handling person (see Appendix II for the template); 5. 3 5. letter of commitment (see Appendix III for the template); 6. 4 6. Standard Contract (see Appendix IV for the template); and 7. 5 7. Personal Information Protection Impact Assessment Report (see Appendix V for the template).
(II) Check of Materials and Feedback on Filing Results The provincial cyberspace administration shall, within 15 working days upon receipt of the materials, complete the check of the materials and notify the personal information handler of the filing results. The filing results are divided into Passed and Failure. The provincial cyberspace administration will issue a filing number to the personal information handler if the filing is passed, otherwise, the personal information handler will receive a notice on unsuccessful filing and the reasons therefor. Where personal information handler is required to supplement and perfect materials, the personal information handler shall supplement and perfect the materials and submit them again within ten working days.
(III) Supplementation or Re-filing Within the validity period of the Standard Contract, the personal information handler shall re-conduct an impact assessment of personal information protection, supplement or enter into a Standard Contract anew and perform relevant filing formalities under any of the following circumstances: 1. 1. where the purpose, scope, category, sensitivity, method and storage location of provision of personal information overseas or the overseas recipient’s purpose or method to process personal information has changed, or the overseas storage period of personal information is to be extended; 2. 2. where the rights and interests of personal information may be affected by changes in the policies and regulations on personal information protection of the country or region where the overseas recipient is located; or 3. 15 3. any other circumstance that may affect the rights and interests of personal information. To conclude a supplemental Standard Contract within the term of the Standard Contract, the personal information handler shall submit supplementary materials to the local provincial cyberspace administration; a Standard Contract re-concluded shall be filed anew. The time limit for the check of the supplemented or re-filed materials is 15 working days. The personal information handler shall be responsible for the authenticity of the materials submitted by it. In case of false materials submitted, the filing shall be deemed as failure and the corresponding legal liability will be investigated in accordance with the law. [email protected] 010-55627565
IV. Contact Details for Consultation and Whistleblowing E-mail: [email protected] Tel.: 010- 55627565 Appendices: 1. 2. 3. 4. 5. 1. Requirements for Filing Materials for a Standard Contract for Outbound Transfer of Personal Information 2. Power of Attorney for a Handler (Template) 3. Letter of Commitment (Template) 4. Standard Contract for Outbound Transfer of Personal Information (Template) 5. Personal Information Protection Impact Assessment Report (Template) PAGE/NUMPAGES PAGE/NUMPAGES