Standard Contract Filing Rules for Data Exporters in China
China data exporters filing standard contracts must assess volume thresholds, complete impact assessments, and submit executed filings to provincial CAC offices.
CAC Filing
Meaning
Administrative recordal procedures with the Cyberspace Administration of China establish formal state oversight for cross-border personal data transfers executed by onshore enterprises. A CAC filing requires foreign-invested companies and domestic operators to submit executed standard contracts alongside personal information protection impact assessments to provincial cyberspace authorities within ten working days of contract execution. The submission documents the legal obligations, technical transfer routes, and security measures established between the onshore data exporter and the offshore recipient.
Completion of the recordal process grants legal authorization to maintain outbound data flows within the scope defined by the filing documentation.
Procedural Workflow
Submission steps require the preparation of a standardized dossier containing the signed contract, impact assessment report, and detailed corporate ownership disclosures. The onshore entity submits the dossier to the provincial cyberspace administration where the company holds its official business registration. Local administrative officers review the documentation for formal completeness within fifteen working days before issuing an official filing receipt or returning the file for technical correction.
Rectification requests pause the administrative clock until the submitting enterprise provides revised security protocols or amended contractual clauses.
Compliance Requirement
Contractual parties must align every clause with the official standard contract template issued by regulatory authorities without altering core liability provisions. The submission must detail data retention periods, storage locations, and encryption protocols deployed during cross-border transit. Failure to complete the recordal within statutory timeframes renders outbound transfers illegal under the Personal Information Protection Law.
Administrative sanctions include administrative warning notices, orders to suspend outbound data operations, and corporate fines up to five percent of annual revenue.
Audit Threshold
Provincial regulators perform periodic spot checks on filed documentation to verify operational compliance. Substantial alterations in data processing scale, transfer routes, or recipient corporate structures require the onshore party to execute a supplemental filing.