- The standard contract is the second of PIPL’s three export routes: sign with the overseas recipient, then file with the provincial cyberspace administration.
标准合同是《个保法》三条出境路径中的第二条：与境外接收方签约，再向省级网信部门备案。- Eligibility is fixed by volume bands: non-CIIO, 100k–under 1m non-sensitive or under 10k sensitive individuals, and no important data.
适用以数量区间为界：非CIIO、10万至不满100万人非敏感或不满1万人敏感个人信息，且不含重要数据。- Splitting volumes to dodge the security assessment is expressly prohibited and is judged at group level.
明令禁止以数量拆分规避安全评估，且按集团合并口径认定。- Separate consent and a five-point PIPIA are mandatory prerequisites before the contract takes effect.
合同生效前须取得单独同意并完成涵盖五项重点的个人信息保护影响评估。- Filing is within 10 working days of the contract taking effect, with the PIPIA report and a cross-border description attached.
备案须在合同生效之日起10个工作日内完成，附影响评估报告与出境说明。- The contract runs for its term and lapses if the handler no longer meets the bands or the data drift outside scope.
合同随期限有效，若处理者不再符合区间或数据超出范围即失效。
Cross-Border Transfer of Personal Information via the China Standard Contract: Thresholds, Filing and Model Clauses | 通过标准合同出境个人信息：阈值、备案与合同范本实务
The Second Route and Where It Sits
Article 38 of the Personal Information Protection Law (PIPL) sets out three lawful routes to export personal information: (1) a security assessment organised by the national cyberspace administration (CAC); (2) personal information protection certification; and (3) concluding and filing a standard contract with the overseas recipient. The *Measures for the Standard Contract for Outbound Provision of Personal Information* (CAC Order No. 13, effective 1 June 2023) operationalise route (3). The standard contract is the lightest of the three in terms of upfront gatekeeping—no CAC declaration, no accredited body—but it is available only within tight volume bands and still demands a real compliance file.
Who Qualifies: the Volume Bands
A handler may use the standard contract only if all of the following hold at once:
- it is not a critical information infrastructure operator (CIIO);
- counting cumulatively from 1 January of the current year, it provides abroad the personal information of 100,000 or more but fewer than 1,000,000 individuals, excluding sensitive personal information, or the sensitive personal information of fewer than 10,000 individuals;
- the exported personal information does not include important data.
The count resets each 1 January. A fast-growing platform, SaaS or e-commerce business can fall out of the band mid-year, at which point the security assessment route becomes mandatory.
The Anti-Splitting Rule
Handlers may not use quantity-splitting or similar devices to route, via the standard contract, personal information that should lawfully undergo a security assessment. A group with several China entities feeding one overseas parent should assume the aggregate flow is what the regulator counts. Structuring entities or contracts to stay “just under” a threshold is precisely the conduct the rule targets.
Before You Sign: Consent and the Five-Point PIPIA
Before the standard contract takes effect, the handler must have given the statutory notification, obtained separate consent from the individuals, and carried out a personal information protection impact assessment (PIPIA) examining:
- Whether the handler’s and recipient’s processing purposes, scope and methods are lawful, legitimate and necessary.
- The scale, scope, type and sensitivity of the exported information and the risks to national security, the public interest and individual rights.
- Whether the obligations the recipient undertakes and its management and technical measures can safeguard security.
- The risk of the information being altered, destroyed, leaked, lost or unlawfully used after export, and whether rights-upholding channels remain open.
- The effect of the recipient’s country or region’s personal-information policies and laws on security and individual rights.
The PIPIA report must be kept for at least three years.
Filing: Timing and Materials
The standard contract must follow the annexed model strictly; the parties may add terms that do not conflict with it. The contract takes effect before any export begins. Within 10 working days of the contract taking effect, the handler files with the provincial cyberspace administration where it is located, submitting: (1) the signed standard contract; (2) the PIPIA report; and (3) a description of the outbound provision. The CAC’s filing guide (first edition) sets out the method, process and materials in detail. Where circumstances change—new recipient, new purpose, new sensitive categories—the handler must re-run the PIPIA, supplement or re-execute the contract, and re-file.
What the Model Clauses Actually Require
The annexed model allocates obligations: the handler must inform individuals of the recipient’s name, contacts, purposes, types of personal information, methods, individual rights and the complaint channel; the overseas recipient must perform the contract, accept individual rights requests, and cooperate with supervision. It also fixes the governing-law and dispute-resolution expectations and includes appendices—a description of the outbound provision and any separately agreed terms. The contract is the evidentiary core of the route: if the file is thin, the export is exposed even when the volume band is satisfied.
Standard Contract Against the Other Two Routes
| Route | Trigger | Gatekeeping step | Validity | Users |
|---|---|---|---|---|
| Security assessment | CIIO exports, important data, or volumes above the band | CAC declaration and assessment | Per that regime | Any handler triggering it |
| Certification | Non-CIIO; 100k–<1m non-sensitive or <10k sensitive; no important data | Accredited body audit plus supervision | 3 years | Voluntary, non-CIIO |
| Standard contract | Same bands as certification | Contract signed, filed with provincial CAC | Contract term | Non-CIIO |
Practical Steps for a Foreign-Invested Enterprise
- Count first, tracking cumulative exports from 1 January and separating sensitive from non-sensitive data.
- Rule out important data and CIIO status before assuming the contract is available.
- Consolidate group flows; the anti-splitting rule bites at group level.
- Fix the consent stack and run the PIPIA against the five points, especially the recipient jurisdiction’s legal regime.
- Sign, then file within 10 working days, keeping the PIPIA report for three years and re-filing on material change.
Related Reading
See our PIPL cross-border transfer overview (No. 35), the field-level data export negative list (No. 57) and the third route—PI export certification (No. 174).
通过标准合同出境个人信息：阈值、备案与合同范本实务
第二条路径及其定位
《个人信息保护法》第三十八条列出三条合法出境路径：（1）国家网信部门组织的出境安全评估；（2）个人信息保护认证；（3）与境外接收方订立标准合同并备案。《个人信息出境标准合同办法》（国家网信办令第13号，2023年6月1日施行）落地第（3）项。标准合同是三条路径中事前门槛最轻的——无需向网信部门申报评估，也无需有资质机构——但仅在严格数量区间内可用，且仍须具备真实合规档案。
适用条件：数量区间
处理者使用标准合同须同时满足以下全部条件：
- 属于非关键信息基础设施运营者（非CIIO）；
- 自当年1月1日起累计向境外提供10万人以上、不满100万人个人信息（不含敏感个人信息），或者不满1万人敏感个人信息；
- 出境个人信息不包括重要数据。
累计数每年1月1日重新起算。快速增长的平台、SaaS或电商业务可能年中越出区间，届时须改走安全评估路径。
反规避条款
处理者不得采取数量拆分等手段，将依法应当通过出境安全评估的个人信息经标准合同出境。多家中国主体向同一境外母公司回传数据的集团，应默认监管看合并总量。为”压线”而拆分主体或合同，正是该条款所针对的行为。
签约前：同意与五项重点影响评估
标准合同生效前，处理者必须已依法履行告知义务、取得个人单独同意，并开展个人信息保护影响评估（PIPIA），重点评估：
- 处理者与境外接收方处理目的、范围、方式的合法性、正当性、必要性；
- 出境信息的规模、范围、种类、敏感程度及其对国家安全、公共利益、个人信息权益的风险；
- 境外接收方承诺承担的义务及其管理和技术措施能否保障安全；
- 出境后信息遭篡改、破坏、泄露、丢失、非法利用的风险，以及权益维护渠道是否通畅；
- 境外接收方所在国家或地区个人信息保护政策法规对安全与权益的影响。
影响评估报告须至少保存三年。
备案：时限与材料
标准合同须严格按附件范本订立，双方可约定不与范本冲突的其他条款。合同生效后方可开展出境。合同生效之日起10个工作日内，处理者向所在地省级网信部门备案，提交：（1）已签署的标准合同；（2）影响评估报告；（3）出境说明。网信办《备案指南（第一版）》对方式、流程与材料作出具体说明。情形变更——新接收方、新目的、新增敏感类别——须重新评估、补充或重订合同并重新备案。
范本条款究竟要求什么
附件范本分配了双方义务：处理者须告知个人接收方名称、联系方式、目的、个人信息种类、方式、个人权利及投诉渠道；境外接收方须履行合同、响应个人权利请求并配合监管。范本还约定了准据法与争议解决预期，并含两份附录——出境说明与另行约定条款。合同是本条路径的证据核心：即便数量区间满足，档案单薄仍会使出境暴露风险。
标准合同与另两条路径对比
| 路径 | 触发阈值 | 主管环节 | 有效期 | 适用主体 |
|---|---|---|---|---|
| 出境安全评估 | CIIO出境、含重要数据或超出合同区间 | 向网信部门申报评估 | 依该制度 | 触发任一条件者 |
| 个人信息保护认证 | 非CIIO；10万至不满100万人非敏感或不满1万人敏感；不含重要数据 | 有资质机构认证并持续监督 | 3年 | 自愿的非CIIO |
| 标准合同备案 | 与认证相同区间 | 签约并向省级网信部门备案 | 合同期限 | 非CIIO |
外资企业的实操步骤
- 先做计数：自1月1日起跟踪累计出境量，区分敏感与非敏感数据。
- 先排除重要数据与CIIO身份，再判断标准合同是否可用。
- 合并集团数据流，反规避条款在集团层面生效。
- 修好同意链路并开展影响评估，尤其是接收方所在法域的法律制度评估。
- 签约后10个工作日内备案，影响评估报告保存三年，重大变更重新备案。
延伸阅读
可参阅本站PIPL跨境传输总览（编号35）、字段级数据出境负面清单（编号57）与第三条路径——个人信息出境认证（编号174）。
Sources