China's Cross-Border Data Transfer Rules Explained
Most foreign businesses only find out about China’s cross-border data rules when someone in legal asks a question nobody on the infrastructure side can answer: if a user in Shanghai signs up and their details end up on a server in Tokyo, is that a regulated data export?
The honest answer is “it depends on how the data got there and who sent it.” The analysis depends on the collection model, responsible entities, and data categories, and the 2024 rule changes exempted many qualifying transfers from the three formal mechanisms, while other personal-information obligations remain.
The applicable requirements depend on the data, the organizations handling it, and any exemptions. Use the thresholds below to map your obligations, then have a China data-law specialist assess the proposed transfers.
The three laws behind the rules
China’s data regulations rest on three national laws. The Cybersecurity Law took effect in 2017 and introduced data localization for operators of critical information infrastructure. The Data Security Law, effective September 2021, created the concept of “important data” and a classification system for it.
The Personal Information Protection Law, or PIPL, took effect on 1 November 2021 and is the one that matters most for typical businesses. It’s China’s closest equivalent to GDPR, covering consent, data subject rights, and, in Chapter III, the rules for moving personal information outside the country.
The Cyberspace Administration of China, the CAC, is the main regulator. It issues the implementing measures that turn the laws’ general principles into specific procedures and thresholds.
The three transfer mechanisms
Under Article 38 of the PIPL, a personal information processor that needs to send personal data outside mainland China generally has to use one of three mechanisms.
The first is a CAC security assessment. This is a formal government review, filed through the provincial cyberspace office and decided by the CAC, covering the purpose and necessity of the transfer, the data involved, and the recipient’s protections. It’s the heaviest route and can take months.
The second is the China standard contract. The CAC publishes a fixed template contract between the Chinese exporter and the overseas recipient, similar in spirit to the EU’s Standard Contractual Clauses. Once signed, it has to be filed with the provincial cyberspace office along with a personal information protection impact assessment.
The third is certification by a recognized professional institution. It’s often used for transfers within multinational groups. The CAC issued dedicated certification measures that took effect on 1 January 2026, giving it a clearer procedure than it had when the PIPL was first passed.
Whatever the mechanism, the PIPL also requires the processor to tell individuals about the transfer and get their separate consent where consent is the legal basis, and to complete an impact assessment before the transfer happens.
Who needs which mechanism
The thresholds were reset in March 2024 and now work roughly like this, counted cumulatively from 1 January of the current year. Check the applicable scenario exemptions first; the non-CIIO volume rows below assume no important data and no exemption:
| Situation | Mechanism required |
|---|---|
| Critical information infrastructure operator transferring personal data or important data | Security assessment |
| Any processor transferring important data | Security assessment |
| Non-sensitive personal data of at least 1 million individuals | Security assessment |
| Sensitive personal data of at least 10,000 individuals | Security assessment |
| Non-sensitive personal data of at least 100,000 but fewer than 1 million individuals | Standard contract or certification |
| Sensitive personal data of fewer than 10,000 individuals | Standard contract or certification |
| Non-sensitive personal data of fewer than 100,000 individuals (non-CIIO) | Exempt from all three |
“Sensitive personal information” under the PIPL is a broad category, covering biometrics, religious beliefs, specific identities, medical and health data, financial accounts, location tracking, and any personal data of minors under 14. A business that thinks of itself as handling ordinary data can still cross into sensitive territory through payment details or location logs.
What the 2024 relaxation changed
Before 2024, the thresholds were lower and the exemptions few, which left many ordinary multinationals filing standard contracts for routine operations. The CAC’s Provisions on Promoting and Regulating Cross-Border Data Flows, effective 22 March 2024, loosened that considerably.
The biggest change was a set of scenario-based exemptions. Transfers don’t need any of the three mechanisms when they’re necessary to perform a contract the individual is party to, such as cross-border shopping, delivery, payment, account opening, flight and hotel bookings, or visa applications. Cross-border HR management under lawful employment rules is exempt, and so are transfers needed to protect someone’s life, health, or property in an emergency.
The provisions also exempted data collected and generated outside China that’s merely processed in China and sent back out, as long as no domestic personal data or important data gets mixed in. They clarified that data isn’t “important data” unless a regulator has notified you or publicly identified it as such. And they extended the validity of a security assessment approval from two years to three.
Free trade zones were allowed to publish their own “negative lists” of data that needs a mechanism, with everything not on the list exempt for businesses registered in that zone. Shanghai, Beijing, and Tianjin have all issued lists.
The deciding question: Who controls the collection and transfer?
If a Chinese subsidiary, office, or partner collects personal information and sends it to your Tokyo or Singapore server, assess that entity’s outbound-transfer obligations and any exemption. Remote access from abroad to data stored in China can also require analysis; a physical database move is not the only relevant flow.
Direct collection from mainland users by an offshore service is not an automatic exemption. PIPL Article 3 can apply when a foreign processor offers products or services to individuals in China or analyzes their behavior, and Article 53 can require a Chinese representative or establishment.
Article 7 of the certification measures effective in 2026 allows an overseas processor to apply with assistance from its Chinese establishment or representative. Direct collection by an offshore service therefore needs its own assessment of certification and transfer requirements.
What this means for a typical offshore setup
For a foreign SaaS, ecommerce store, or app serving mainland users directly, assess the PIPL’s extraterritorial scope, representation requirement, and the applicable cross-border route together. No Chinese subsidiary does not, by itself, settle the certification or transfer analysis.
For a multinational with a China office, the picture splits. The China entity’s outbound transfers to group systems, such as HR records, CRM data, and support tickets, fall under the transfer rules, though many now sit inside the 2024 exemptions for contract performance and HR management.
Infrastructure choices interact with this in practical ways. Keeping China-originated data in a clearly defined system makes it easier to count individuals against the thresholds and to show what data went where. Logging which records came from mainland users, and through which path, is far easier to set up on day one than to reconstruct during an audit.
How to work out where you stand
Start by mapping data flows, not servers. For each type of personal data, write down who collects it, where it’s first stored, and every system it moves to afterward. Note whether a Chinese entity touches it along the way.
Next, classify the data. Separate sensitive personal information from ordinary personal data, and check whether any of it could be important data in your sector. If no regulator has notified you and nothing appears in a published catalog, the 2024 provisions say you can treat it as not important.
Then check the exemptions. Many transfers fall under contract performance or HR management, and a volume below 100,000 individuals a year of non-sensitive data needs no mechanism at all for a non-CIIO.
For whatever’s left, pick the mechanism. Count individuals cumulatively from 1 January, and choose between the standard contract, certification, or a security assessment according to the thresholds. Build the impact assessment and consent flows before the transfer starts, not after.
Finally, get local advice. Interpretation varies between provincial offices, guidance keeps evolving, and enforcement priorities shift. A short engagement with a China data lawyer, focused on your actual data map, is worth far more than general research.
Wrapping up
China’s cross-border data transfer rules apply mainly to data exported by processors inside China, using a security assessment, standard contract, or certification depending on volume and sensitivity. The March 2024 provisions exempted a large share of everyday business transfers and raised the thresholds, so fewer companies need formal filings than before.
For a foreign-hosted service collecting directly from users in China, assess the PIPL’s general obligations, extraterritorial reach, representation requirements, and relevant cross-border procedures together. Map your flows, classify your data, check the exemptions, and get specific advice on what’s left.
Thanks for reading! If you’re running a China-facing service from outside the mainland, Riven Cloud runs KVM VPS in Tokyo and Singapore with premium CTGNet, CUP, and CMIN2 routing to all three major Chinese carriers, and a public Looking Glass in each location so you can check the path yourself.
Want to talk through your setup? Compare plans or contact our team with questions.
Frequently asked questions about China’s cross-border data transfer rules
What are the three mechanisms for transferring personal data out of China?
A CAC security assessment, the China standard contract filed with the provincial cyberspace office, or certification by a recognized professional institution. Which one applies depends on the type of processor, the volume of data, and whether it’s sensitive.
What changed in China’s March 2024 data transfer rules?
The CAC raised the thresholds, exempted transfers needed for contract performance, cross-border HR management, and emergencies, exempted non-CIIOs transferring non-sensitive data of fewer than 100,000 individuals a year, and extended security assessment approvals to three years.
Does a server in Tokyo or Singapore count as a cross-border data transfer?
It depends on who sends the data there. If a Chinese entity collects data and passes it to your offshore server, that’s an outbound transfer. Direct submission to an offshore service is not an automatic exemption. The PIPL can apply extraterritorially, and the 2026 certification measures expressly address applications by foreign processors through their Chinese representative or establishment.
Does the PIPL apply to companies outside China?
Yes, when they process personal data of individuals in China to provide them products or services, or to analyze their behavior. Covered foreign processors also need to designate a representative or entity in China.
What counts as sensitive personal information under the PIPL?
Biometric data, religious beliefs, specific identities, medical and health information, financial accounts, location tracking, and any personal information of minors under 14, along with other data that could easily harm someone’s dignity or safety if leaked.
Do I need a lawyer to comply with China’s data export rules?
For anything beyond a simple, clearly exempt setup, yes. Provincial interpretation varies and the rules keep evolving, so specific advice based on your own data map is the most reliable path.
Share