Navigating Personal Information Cross Border Transfer Verification Thresholds
Verify outbound headcount annually from January 1: under 100k non-sensitive records is exempt, while 10k sensitive records forces central CAC assessment.
Contractual Necessity Valve
Meaning
Statutory exceptions to the requirement for individual consent allow data controllers to process personal information to fulfill legal obligations. The contractual necessity valve operates when the performance of a contract to which the individual is a party makes certain data processing indispensable. It provides a legal path for logistics providers to process recipient addresses without obtaining a fresh signature for every package.
Legal Justification
Article 13 of the Personal Information Protection Law provides the grounding for this specific processing basis. While consent is the primary ground for data handling, the contractual necessity valve acts as a parallel justification that does not require the individual to opt in. This justification relies on the objective impossibility of fulfilling the contract without the data.
Operational Threshold
Use of this exception requires a strict assessment of what is truly required for the transaction. A controller invokes the contractual necessity valve only for data points like payment details or shipping coordinates. Collecting preference data or marketing history usually falls outside this boundary because the primary contract remains performable without such information.
Compliance Constraint
Regulatory scrutiny of this mechanism focuses on preventing the overuse of non-consensual processing. If a company oversteps, the Cyberspace Administration of China can demand a return to the consent-based model.