CAC 2024 Provisions on Promoting and Regulating Cross-Border Data Flows, Articles 5, 7 and 8: the route depends on how many people's information goes abroad each year (Cyberspace Administration of China, Provisions on Promoting and Regulating Cross-Border Data Flows (Order No. 16, 22 Mar. 2024, in force on publication), Arts. 5(4), 7(2) and 8 (Chinese text))
Translation: a non-critical-infrastructure handler that sends abroad the information of fewer than 100,000 people (not counting sensitive information) cumulatively since 1 January is exempt from the security assessment, standard contract and certification; it must apply for a government security assessment if it sends important data, or the information of 1,000,000 or more people (or sensitive information of 10,000 or more); and between those levels it must sign the standard contract with the overseas recipient or obtain certification. A holder with a customer base of a few thousand people is therefore usually in the exempt band, but the notice and separate consent duties still apply (next entry).
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
“（四）关键信息基础设施运营者以外的数据处理者自当年1月1日起累计向境外提供不满10万人个人信息（不含敏感个人信息）的。 ... （二）关键信息基础设施运营者以外的数据处理者向境外提供重要数据，或者自当年1月1日起累计向境外提供100万人以上个人信息（不含敏感个人信息）或者1万人以上敏感个人信息。 ... 关键信息基础设施运营者以外的数据处理者自当年1月1日起累计向境外提供10万人以上、不满100万人个人信息（不含敏感个人信息）或者不满1万人敏感个人信息的，应当依法与境外接收方订立个人信息出境标准合同或者通过个人信息保护认证。”
It is shown on its own, not counted into a figure.
Cited in this guide