Personal Information Impact Assessment Execution for Cross Border Data Recipient Verification
Cross border recipient verification demands binding audit terms, continuous access logging, and verified key destruction upon contract termination.
Standard Contract Clauses
Meaning
Statutory contractual templates issued by the Cyberspace Administration of China establish mandatory data protection terms for exporting personal information to foreign recipients. Under Article 38 of the Personal Information Protection Law, standard contract clauses provide a compliant transfer mechanism for data handlers that fall below mandatory security assessment thresholds. The mechanism requires domestic data exporters and foreign offshore recipients to execute unmodified statutory contract terms governing data processing and individual rights protection.
The provisions govern cross-border vendor agreements and corporate group data sharing. The regulatory framework stops applying when personal information transfers cross statutory thresholds that trigger mandatory government security assessments.
Regulatory Filing
Data handlers must file the executed standard contract and a personal information protection impact assessment with provincial cybersecurity authorities within ten working days of contract effectiveness. Registration allows regulatory bodies to monitor cross-border data transfer structures without conducting pre-transfer administrative approvals.
Contractual Obligation
The clause framework obligates foreign data recipients to submit to Chinese regulatory jurisdiction and legal remedies for data privacy breaches. Offshore recipients must maintain audit records and grant data subjects third-party beneficiary rights during contract operations.
Operational Limit
Modifying or omitting mandatory text within standard contract clauses invalidates the transfer mechanism under Chinese cyber law. Exporters cannot alter liability distribution clauses or choice of law provisions directing disputes to Chinese courts or designated arbitration bodies. Non-compliant contractual modifications expose data exporters to administrative suspension orders and substantial financial penalties.