PIPL Articles 38, 39 and 41: sending personal information abroad needs a security assessment, certification or standard contract, plus separate consent, and foreign authorities cannot be given it without approval (Personal Information Protection Law of the PRC (adopted 20 Aug. 2021, in force 1 Nov. 2021; Chinese text published by the Cyberspace Administration of China), Arts. 38(1), 39 and 41)

Translation: to send personal information abroad a handler must meet one of these conditions: pass a security assessment organised by the national cyberspace authority, obtain certification by a professional body, or sign the standard contract with the overseas recipient (or another condition set by law); it must also tell the individual the recipient's name, contact details, purpose, method, the types of information and how to exercise rights against the recipient, and obtain separate consent. Information stored in China may not be given to foreign judicial or law enforcement bodies without Chinese approval.

Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text

In the source's own words

“个人信息处理者因业务等需要，确需向中华人民共和国境外提供个人信息的，应当具备下列条件之一：（一）依照本法第四十条的规定通过国家网信部门组织的安全评估；（二）按照国家网信部门的规定经专业机构进行个人信息保护认证；（三）按照国家网信部门制定的标准合同与境外接收方订立合同，约定双方的权利和义务； ... 个人信息处理者向中华人民共和国境外提供个人信息的，应当向个人告知境外接收方的名称或者姓名、联系方式、处理目的、处理方式、个人信息的种类以及个人向境外接收方行使本法规定权利的方式和程序等事项，并取得个人的单独同意。 ... 非经中华人民共和国主管机关批准，个人信息处理者不得向外国司法或者执法机构提供存储于中华人民共和国境内的个人信息。”

Where it was read

PIPL Articles 38, 39 and 41: sending personal information abroad needs a security assessment, certification or standard contract, plus separate consent, and foreign authorities cannot be given it without approval, China, checked 18 Oct 2026
Everything read from this source (3)