Data Export Assessment (数据出境)

Sending data from mainland China to anywhere else, including a parent company's systems abroad, is regulated by the Personal Information Protection Law, the Data Security Law and the Cybersecurity Law, with routes and thresholds set by the Cyberspace Administration of China (CAC). Since the 2024 provisions on promoting and regulating cross-border data flows, many transfers are exempt, while others need a standard contract filing, certification, or a security assessment. This skill maps the data, finds the route, and lists what to prepare.

Write in Simplified Chinese unless asked otherwise. Thresholds and exemptions are set by CAC rules and may change, and free trade zones can publish their own negative lists; confirm with current CAC guidance and counsel. This is preparation, not legal advice.

Required Inputs

Ask for these if not provided:

• What data leaves China: categories, whether it includes personal information, sensitive personal information (敏感个人信息) or important data (重要数据), and volumes since 1 January this year
• Why: the business purpose (contract with the individual, cross-border HR management, group IT, analytics, AI training)
• Who receives it, where, and how (system access, transfer, cloud)
• Whether the company is a critical information infrastructure operator (CIIO)
• Location, including any free trade zone

Output Structure

1. Data map

| Data | Category (personal, sensitive, important, other) | Volume this year | Recipient and country | Purpose | Channel |

2. Route decision

Walk the rules in order and show the result for each data flow:

1. Exemptions: for example transfers necessary to perform a contract with the individual, cross-border HR management under lawful policies, emergencies, or low-volume non-sensitive personal information (thresholds to confirm)
2. Security assessment (CAC): typically for important data, CIIOs, or high volumes of personal information or sensitive personal information
3. Standard contract or certification: typically for volumes between the exemption and assessment thresholds State the threshold relied on for each step as "to confirm against current CAC provisions".

3. Steps for the chosen route

| Step | Who | Output | For a standard contract: the personal information protection impact assessment, signing the CAC template contract unchanged, and filing with the provincial CAC within the required period. For an assessment: self-assessment, application, CAC review. For an exemption: the record showing why it applies.

4. Documents to prepare

The impact assessment (see cn-pipl-pia), notices and separate consent where required, the data map, recipient due diligence, and security measures.

Quality Checks

• Every data flow has a category, a volume and a purpose
• Each flow is walked through exemptions, assessment and standard contract in order
• Every threshold is marked to confirm against current CAC provisions
• Sensitive personal information and important data are identified separately
• The steps for the chosen route include the impact assessment where it is required
• The output states it is not legal advice

Anti-Patterns

• Assuming group-internal transfers are free. A parent company abroad is still overseas.
• Counting only this month. Volumes accumulate from 1 January.
• Editing the standard contract. The CAC template must be used as issued; add terms in a separate agreement.
• Ignoring remote access. Letting overseas staff view data in China can count as export.

Example Trigger Phrases

• "我们要把员工数据同步到新加坡总部，需要申报吗？"
• "个人信息出境标准合同怎么备案？"
• "数据出境安全评估的门槛是什么？我们够不够？"
• "Do we need a CAC assessment to send customer data from China to the EU?"