Standard Contract Filing Rules for Data Exporters in China
China data exporters filing standard contracts must assess volume thresholds, complete impact assessments, and submit executed filings to provincial CAC offices.
Security Assessment Threshold
Meaning
Quantitative or qualitative triggers established by Chinese data regulations define when a company must undergo a mandatory state review before transferring information across borders. The security assessment threshold is primarily governed by the Cyberspace Administration of China under the Measures for the Security Assessment of Outbound Data Transfers. Reaching this limit forces an organization to submit its data handling practices for government scrutiny to ensure national security remains protected.
Volume Triggers
Specific numbers of individual records determine the legal requirements for a filing. If an entity processes the personal information of more than one million people, it automatically meets the security assessment threshold for any overseas transfer. Additionally, exporting the personal information of 100,000 individuals or the sensitive personal information of 10,000 individuals since January 1 of the previous year triggers the same obligation.
Data Classification
The nature of the information can activate the review process regardless of the total quantity. If the data is classified as important data by a relevant industry regulator, the security assessment threshold is met immediately. This applies to sectors like automotive, finance and healthcare where the information could impact public interest or economic stability.
Compliance Execution
Failing to identify when these limits are crossed can result in significant administrative fines and the suspension of data exports. Companies must conduct a self assessment before applying for the official state review. This internal audit ensures that the legal basis for the transfer is sound and that the recipient in the foreign country provides an adequate level of protection.