All posts by adm0n

Data Export / 数据出境

FTZ Data Export Negative List and Facilitated Cross-Border Channels

  • The CAC “Provisions on Promoting and Regulating Cross-Border Data Flows” (CAC Decree No. 16, 22 March 2024) let free-trade zones formulate their own data-export negative lists under the national data classification framework.
    国家网信办《促进和规范数据跨境流动规定》（2024年3月22日，第16号令）授权自由贸易试验区在国家数据分类分级保护制度框架下自行制定数据出境负面清单。
  • A free-trade zone’s negative list identifies the data whose outbound provision still requires security assessment, standard contract or certification; data outside the list may flow out freely without those filings.
    自贸试验区负面清单列明仍须申报安全评估、订立标准合同或通过认证方可出境的数据；清单外数据可免予申报、自由出境。
  • Tianjin released China’s first FTZ data-export negative list (May 2024), dividing outbound data into 13 categories and 46 sub-categories with concrete examples.
    天津于2024年5月发布全国首份自贸试验区数据出境负面清单，将出境数据分为13大类46子类并辅以具体示例。
  • Shanghai (Lin-gang) published its negative list (February 2024) covering finance (reinsurance), shipping and commerce across 6 scenarios and 84 data items, with field-level detail and a “use-first, file-later” approach.
    上海（临港）于2024年2月发布负面清单，覆盖金融（再保险）、航运、商贸3个领域6个场景84个数据项，细化至字段级并实行”先用后报”。
  • Beijing’s FTZ negative list (August 2024) is the first scenario- and field-level list, spanning autos, pharma, civil aviation, retail and AI training data across five industries.
    北京自贸试验区负面清单（2024年8月）为首个场景化、字段级清单，涵盖汽车、医药、民航、零售与现代服务业、人工智能训练数据5个行业。
  • Foreign-invested enterprises in FTZs should map outbound data to the applicable negative list, use the one-stop data centre service, and rely on the list’s free-flow carve-out to cut compliance cost.
    区内外商投资企业应将出境数据对照适用负面清单，利用一站式数据跨境服务中心，并借助清单”清单外自由流动”豁免降低合规成本。

FTZ Data Export Negative List and Facilitated Cross-Border Channels | 自由贸易试验区数据出境负面清单与便利化通道

Why this matters now

For a foreign-invested enterprise moving R&D, manufacturing, sales or HR data across borders, China’s data-export rules have long been criticised as uncertain — particularly the vague definition of “important data.” The 2024 reform changed the geometry of that problem. By empowering each free-trade zone (FTZ) to publish its own data-export negative list, Beijing created a field-level, scenario-based map that tells companies, with far greater precision, which data can leave freely and which still triggers a security assessment, standard contract or certification. For multinationals clustered in FTZs, the negative list is now the single most practical compliance instrument for cross-border data.

The enabling rule

The Provisions on Promoting and Regulating Cross-Border Data Flows (Cyberspace Administration of China Decree No. 16, effective 22 March 2024) is the legal foundation. Article 6 authorises an FTZ, within the national data classification and grading protection system, to formulate its own list of data that must enter the security-assessment / standard-contract / certification regime, subject to provincial cyberspace-authority approval and filing with the national cyberspace and data authorities. Critically, data exported by an FTZ entity that falls outside the negative list is exempt from the security assessment, standard contract and certification obligations. The Provisions also carve out routine cross-border scenarios — international trade, cross-border transport, academic cooperation, multinational manufacturing and marketing, and certain HR-management and low-volume personal-information transfers — from filing requirements altogether.

Tianjin: the first negative list

In May 2024, the China (Tianjin) Pilot Free Trade Zone became the first to issue a data-export negative list under the new rule — now filed with the national authorities. It organises outbound data into 13 major categories and 46 sub-categories spanning biomedicine, services outsourcing, finance, internet platforms, automotive, integrated circuits, meteorology and international trade, with detailed feature descriptions and concrete examples for each. The list makes “important data” identifiable rather than abstract: a chemical firm’s hazardous-materials transport-route planning, for instance, is explicitly mapped to a sub-category requiring security assessment. Together with Tianjin’s earlier data classification standard, it forms a “double first” policy system for cross-border data.

Shanghai (Lin-gang): field-level and “use-first”

Shanghai published its negative list (February 2024, with a management measure and implementation guide) covering finance (reinsurance), shipping (international shipping) and commerce (retail, food and beverage, accommodation) — six scenarios and 84 data items. Its distinguishing features:

  • Scenario names are listed first, so companies can match their activity directly.
  • Important-data features are refined in finance and shipping to aid identification.
  • Thresholds are eased where risk is controllable — for example, the sensitive personal-information assessment threshold in commerce membership management rises from 10,000 to 1,000,000, sharply lowering compliance cost.
  • A “use-first, file-later” principle applies: no entry barrier — a company simply submits its negative-list usage materials within 15 working days of starting the export.
  • Five district service centres plus a Lin-gang centre provide one-stop policy consultation and pre-check.

Beijing: scenario- and field-level pioneer

Beijing’s FTZ negative list (August 2024) was the first scenario- and field-level list, proposing a 13-category / 41-sub-category reference framework and enumerating compliance measures for five industries — automotive, pharmaceutical, civil aviation, retail and modern services, and AI training data — across 48 data categories. It added a provincial pre-review and pre-assessment mechanism and a green-channel service covering more than 100 enterprises in five sectors.

The compliance upside

The negative-list model turns data-export compliance from a national guess into a local, field-level answer. For an FIE, three gains stand out: first, certainty — once a dataset is mapped out-of-list, the assessment/contract/certification filings drop away; second, speed — Shanghai’s “use-first, file-later” removes the pre-clearance wait for in-list routine flows; third, cost — eased thresholds (such as Tianjin and Shanghai raising sensitive-PI triggers) materially lower the volume of filings. The trade-off is geography: the list is FTZ-specific, so an entity outside a pilot zone cannot rely on it and must fall back to the national thresholds in the CAC Provisions. Multinationals should therefore weigh FTZ location as a data-governance variable, not merely a tax or logistics one.

Practical steps for foreign-invested enterprises

  1. Locate your FTZ and list. Determine which FTZ your entity sits in (Tianjin, Shanghai/Lin-gang, Beijing, or others referencing them) and pull the applicable negative list.
  2. Map data to scenarios and fields. Use the scenario-first, field-level structure to classify each outbound dataset as in-list or out-of-list.
  3. Claim the free-flow carve-out. For out-of-list data, document the basis and export without the assessment/contract/certification filings.
  4. Use the one-stop centre. Submit materials within the prescribed window and use pre-check to de-risk.
  5. Watch interoperability. Shanghai and others mutually recognise negative lists; a list published by another FTZ may be referenced, so monitor second-batch lists in your sector.

Related reading

The negative list is one lane of China’s three-track data-export system — alongside the security assessment, the standard contract and certification. FIEs should read the FTZ list together with the national thresholds in the CAC Provisions and the general data-security and personal-information rules.

自由贸易试验区数据出境负面清单与便利化通道

为何当下值得关注

对跨境传输研发、制造、销售或人力资源数据的外商投资企业而言，中国的数据出境规则长期因”重要数据”界定模糊而被视为不确定。2024年的改革改变了这一问题的几何结构。通过授权每个自由贸易试验区（FTZ）发布各自的数据出境负面清单，决策层创建了一张字段级、场景化的地图，以更高精度告知企业：哪些数据可自由出境，哪些仍须触发安全评估、标准合同或认证。对聚集在自贸区的跨国企业而言，负面清单已成为跨境数据合规最务实的单一工具。

授权规则

《促进和规范数据跨境流动规定》（国家互联网信息办公室令第16号，2024年3月22日施行）是法律基础。第六条授权自由贸易试验区在国家数据分类分级保护制度框架下，自行制定区内须纳入数据出境安全评估、个人信息出境标准合同、个人信息保护认证管理范围的数据清单，经省级网信委员会批准并报国家网信部门、国家数据管理部门备案。关键在于，自贸试验区内数据处理者向境外提供负面清单外的数据，可免予申报安全评估、订立标准合同、通过认证。该规定还将国际贸易、跨境运输、学术合作、跨国生产制造与市场营销，以及特定人力资源管理与低量级个人信息传输等常规场景，整体排除出申报要求。

天津：首份负面清单

2024年5月，中国（天津）自由贸易试验区率先发布新规下的数据出境负面清单（已完成国家备案）。其将出境数据分为13大类46子类，覆盖生物医药、服务外包、金融、互联网平台、汽车、集成电路、气象、国际贸易等领域，并对每一类给出详细特征描述与具体示例。清单使”重要数据”从抽象变为可识别：例如某化工企业的危化品运输路线规划，被明确映射至须申报安全评估的子类。叠加天津此前的数据分类分级标准，形成自贸试验区”双首个”数据跨境政策体系。

上海（临港）：字段级与”先用后报”

上海于2024年2月发布负面清单（配套管理办法与实施指南），覆盖金融（再保险）、航运（国际航运）、商贸（零售与餐饮、住宿）三大领域，涉及6个场景84个数据项。其突出特征：

  • 场景名称前置单列，便于企业直接对应适用。
  • 在金融、航运领域对重要数据进一步细化，辅助识别。
  • 风险可控前提下放宽阈值——例如商贸会员管理场景的敏感个人信息安全评估阈值由1万提升至100万，显著降低合规成本。
  • 实行“先用后报”原则：不设准入门槛，企业自开展数据出境活动之日起15个工作日内提交使用材料即可。
  • 五大片区服务中心加临港中心提供一站式政策咨询与材料初核。

北京：场景化、字段级先锋

北京自贸试验区负面清单（2024年8月）为首个场景化、字段级清单，提出13大类41子类参考规则，并列举汽车、医药、民航、零售与现代服务业、人工智能训练数据5个行业48类数据的出境合规措施。其增设省级预审核、预评估机制，并建立覆盖5个行业100余家企业的绿色通道服务。

合规红利

负面清单模式将数据出境合规从”全国猜谜”转变为”本地、字段级作答”。对外资企业而言，三重收益突出：其一，确定性——数据集一旦被归入清单外，评估/合同/认证申报即告免除；其二，速度——上海”先用后报”免除了清单内常规流程的事前审批等待；其三，成本——放宽后的阈值（如天津、上海上调敏感个人信息触发线）大幅减少申报量。代价是地域性：清单以自贸区为界，区外实体无法依赖，须回退至《促进和规范数据跨境流动规定》的全国统一阈值。因此，跨国企业应将自贸区选址视为数据治理变量，而非仅关乎税收或物流。

外商投资企业实务步骤

  1. 定位所在自贸区与清单。 确定实体所属自贸区（天津、上海/临港、北京或参照它们的其他区），调取适用负面清单。
  2. 将数据映射到场景与字段。 利用”场景前置、字段级”结构，将每个出境数据集归类为清单内或清单外。
  3. 主张自由流动豁免。 对清单外数据，留存依据并免予评估/合同/认证申报即可出境。
  4. 使用一站式中心。 在规定时限内提交材料，借助初核降低风险。
  5. 关注互认与扩围。 上海等地可参照执行其他自贸区清单；密切跟踪本行业第二批清单。

延伸阅读

负面清单是中国数据出境”三轨”（安全评估、标准合同、认证）中的一条快捷通道。外资企业应将自贸区清单与《促进和规范数据跨境流动规定》中的全国统一阈值及数据安全、个人信息保护一般规则一并研读。

Sources

  • 国家互联网信息办公室令第16号：《促进和规范数据跨境流动规定》（2024-03-22）— https://big5.www.gov.cn/gate/big5/www.gov.cn/gongbao/2024/issue_11366/202405/content_6954192.html
  • 天津自贸试验区数据出境管理清单（负面清单）（2024版）— https://big5.www.gov.cn/gate/big5/www.gov.cn/lianbo/difang/202405/content_6950083.htm
  • 中国（上海）自由贸易试验区及临港新片区数据出境管理清单（负面清单）（2024版）答记者问（临港新片区管委会）— https://www.lingang.gov.cn/upload/1/cms/content/editor/ac2a296d-70a3-47fc-9008-fe5d887eaf73.pdf
Data Export / 数据出境

China’s Data Export Security Assessment Route (2026): a Field Guide for Foreign-Invested Enterprises

  • The security assessment is the highest-threshold of China’s three data-export routes and is mandatory when a Critical Information Infrastructure Operator (CIIO) exports personal information, or when any processor exports important data or large volumes of personal information.
    安全评估是中国数据出境三条通道中门槛最高的一条，当关键信息基础设施运营者（CIIO）出境个人信息，或任何处理者出境重要数据、或大规模出境个人信息时，必须申报安全评估。
  • The statutory triggers are: CIIO exporting PI; any exporter of important data; exporters of over 1 million individuals’ personal information; and those who since 1 January of the current year have cumulatively exported over 100,000 individuals’ PI or over 10,000 individuals’ sensitive PI.
    法定触发情形为：关键信息基础设施运营者出境个人信息；任何重要数据出境方；累计出境个人信息超过 100 万人的处理者；以及自当年 1 月 1 日起累计出境个人信息超过 10 万人或敏感个人信息超过 1 万人的处理者。
  • The 2024 Provisions exempt a long tail of low-risk flows — notably general cross-border HR management, contract-performance necessity, and sub-100k non-sensitive PI — so many FIEs fall outside the assessment entirely.
    2024 年《促进和规范数据跨境流动规定》豁免了大量低风险出境情形——尤其是常规跨境人力资源管理、履行合同必需，以及 10 万人以下的非敏感个人信息出境，因此许多外资企业实际上不落入安全评估范围。
  • The assessment runs through a provincial网信 office to the national CAC, with a 7-working-day acceptance decision, a 45-working-day review (extendable), a 2-year validity, and a built-in renewal path introduced by the 2024 rules.
    评估由省级网信部门报送国家网信部门，7 个工作日内决定是否受理，45 个工作日内完成评估（可延长），结果有效期 2 年，2024 年规定新增了有效期延长申请机制。
  • FIEs should map their data, identify whether they are a CIIO or a large-volume exporter, and use the third-edition filing guide (2025) and the online system at sjcj.cac.gov.cn to prepare materials before submitting.
    外资企业应先梳理数据资产、判断是否构成 CIIO 或大规模出境方，并依据 2025 年第三版申报指南与”数据出境申报系统”（sjcj.cac.gov.cn）提前备齐材料再申报。
  • The 2026 stabilising-foreign-investment action plan explicitly supports FTZs and service-opening pilot cities in exploring scenario-based, field-level data-export negative lists, which can further narrow what needs assessment.
    2026 年《利用外资固稳促优行动方案》明确支持自贸试验区和服务业扩大开放试点城市探索场景化、字段级数据出境负面清单，可进一步收窄需评估的范围。

China’s Data Export Security Assessment Route (2026): a Field Guide for Foreign-Invested Enterprises | 中国数据出境安全评估通道（2026）：外资企业实操指南

Which route, and why this one

China regulates outbound transfer of data through three parallel mechanisms established under the PIPL, the Data Security Law and the Cybersecurity Law: security assessment (administrative review), the standard contract (filed), and certification (third-party). This article focuses on the first and highest-threshold mechanism — the security assessment administered by the Cyberspace Administration of China (CAC) — because it is the one foreign-invested enterprises (FIEs) most often ask about and most often mis-classify. If your group exports only limited employee or customer data, the standard contract (covered separately) or certification may apply instead; but if you are a CIIO, export important data, or move large volumes of personal information, security assessment is mandatory.

The legal stack

The assessment rests on a layered rule set:

  • The Data Export Security Assessment Measures (CAC Decree No. 11, effective 1 September 2022) set the thresholds, procedures and the two-year validity.
  • The Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Decree No. 16, effective 22 March 2024) relaxed thresholds, created broad exemptions, and introduced the FTZ negative-list system and a renewal path for assessment results.
  • The third-edition Filing Guide for Data Export Security Assessment (released 27 June 2025) simplified and optimised the materials required, and clarified how to apply to extend a valid result.

Together these three instruments define who must file, what to submit, and how long a cleared pathway stays valid.

Who must apply — the triggers

A processor must apply for a security assessment when any of the following applies:

  1. A Critical Information Infrastructure Operator (CIIO) exports personal information.
  2. The processor exports important data.
  3. The processor exports personal information of more than 1,000,000 individuals.
  4. Since 1 January of the current year, the processor has cumulatively exported personal information of more than 100,000 individuals, or sensitive personal information of more than 10,000 individuals.

Items 3 and 4 are the ones that catch multinational groups: a sizeable e-commerce, automotive, healthcare or education business can cross the 100,000-person line in a single year through CRM, loyalty, telematics or learning records.

What the 2024 Provisions took out of scope

Just as important as the triggers is what the 2024 Provisions exempt. The following outbound flows do not require assessment, standard contract or certification:

  • Data generated in international trade, cross-border transport, academic cooperation, multinational manufacturing or marketing that contains no personal information or important data.
  • Personal information collected overseas, processed in China, and returned overseas without introducing domestic PI or important data.
  • Data needed to conclude or perform a contract to which the individual is a party (cross-border shopping, shipping, remittance, payment, account opening, ticketing, visa, exam services).
  • Cross-border human-resources management carried out under lawfully formulated labour rules and collective contracts.
  • Emergency protection of life, health or property.
  • Non-CIIO processors exporting fewer than 100,000 individuals’ non-sensitive PI in a year.

For many FIEs, a careful mapping shows the bulk of routine flows fall into these exemptions, leaving only the high-volume or important-data streams for assessment.

The FTZ negative-list carve-out

Under the 2024 Provisions, a Free Trade Zone may, within the national data classification and grading framework, draw up its own negative list of data that still requires assessment, standard contract or certification. Once the list is approved by the provincial cyberspace affairs commission and filed with the national CAC and data authority, data outside that list may be exported from within the FTZ without any of the three mechanisms. The 2026 stabilising-foreign-investment action plan encourages FTZs and service-opening pilot cities to expand scenario-based, field-level negative lists, so the practical carve-out is widening.

The procedure, step by step

  1. Self-assessment. Before filing, the processor must perform and document a data-export risk self-assessment covering purpose, scope and necessity; the scale, type and sensitivity of the data; the overseas recipient’s safeguards; post-transfer risks; and the contractual protections agreed with the recipient.
  2. File with the provincial office. Submit the application, the self-assessment report, the legal document with the overseas recipient, and supporting materials to the provincial cyberspace administration, which checks completeness within 5 working days and forwards a complete package to the national CAC.
  3. Acceptance. CAC decides whether to accept within 7 working days of receiving a complete package.
  4. Review. CAC organises the assessment within 45 working days (extendable for complexity or supplementary materials). It weighs national-security and public-interest risk, the recipient country’s legal environment, the volume and sensitivity of data, and the adequacy of safeguards.
  5. Result and validity. The written result is valid for 2 years from issuance. The 2024 Provisions added an explicit path to apply to extend validity before expiry when business continues. Major changes to purpose, scope, type, recipient or legal environment require re-assessment.

Practical steps for an FIE

  • Inventory and classify. Build a data map: what you hold, where it came from, who receives it overseas, and whether any of it is “important data” (note: absent a published important-data catalogue for your sector, you are generally not presumed to hold it).
  • Test against thresholds. Tally personal-information subjects per calendar year and flag any CIIO status (often determined by your industry regulator).
  • Prefer exemptions. Route routine HR, contract-performance and sub-threshold flows through the exemptions so they never enter the assessment pipeline.
  • Prepare the legal instrument. The contract or binding document with the recipient must spell out purpose, scope, storage period, re-transfer limits, security measures and breach remedies.
  • Use the online system. File and track through the national data-export system at sjcj.cac.gov.cn, and follow the third-edition guide’s material checklist.
  • Plan for renewal. Set a calendar reminder well before the two-year expiry if the export continues.

Boundaries to keep in mind

Security assessment is not a fast-track; build 2–3 months of lead time. The result is tied to the specific data scope and recipient described — a new use case or a material change in the recipient’s control triggers re-assessment. And the three routes are alternatives, not cumulative: pick the one your facts require rather than layering them.

See also our articles on the standard contract route, the personal-information export certification route, and field-level data-export negative lists.

中国数据出境安全评估通道（2026）：外资企业实操指南

选哪条通道，为什么是这一条

中国依据《个人信息保护法》《数据安全法》《网络安全法》，建立了三条并行的数据出境机制：安全评估（行政审批）、标准合同（备案）与个人信息保护认证（第三方认证）。本文聚焦门槛最高、也是外资企业最常咨询却又最易误判的第一条——由国家网信办（CAC）实施的数据出境安全评估。若贵集团仅出境少量员工或客户数据，标准合同（另有专文）或认证可能更适用；但若属于关键信息基础设施运营者（CIIO）、出境重要数据或大规模出境个人信息，则安全评估为强制性要求。

规则体系

安全评估建立在分层规则之上：

  • 《数据出境安全评估办法》（国家网信办令第 11 号，2022 年 9 月 1 日施行）划定了触发阈值、申报程序与 2 年有效期。
  • 《促进和规范数据跨境流动规定》（国家网信办令第 16 号，2024 年 3 月 22 日施行）下调了阈值、创设了广泛的豁免，并引入自贸试验区负面清单制度与评估结果延长机制。
  • 《数据出境安全评估申报指南（第三版）》（2025 年 6 月 27 日发布）优化简化了申报材料，并明确了如何申请延长有效评估结果。

这三部规则共同界定了”谁必须申报、申报什么、 cleared 路径维持多久”。

谁必须申报——触发情形

处理者在任一下列情形出现时，必须申报安全评估：

  1. 关键信息基础设施运营者（CIIO）出境个人信息。
  2. 处理者出境重要数据。
  3. 处理者出境个人信息超过 100 万人。
  4. 自当年 1 月 1 日起，累计出境个人信息超过 10 万人，或敏感个人信息超过 1 万人。

其中第 3、4 项最易”踩线”：一家颇具规模的电商、汽车、医疗或教育企业，仅凭 CRM、会员体系、车联网或学习记录，一年内就可能突破 10 万人的门槛。

2024 年规定划出的豁免范围

与触发情形同样重要的是 2024 年规定的豁免清单。下列出境活动无需申报评估、订立标准合同或通过认证：

  • 国际贸易、跨境运输、学术合作、跨国生产制造和营销中收集和产生、不含个人信息或重要数据的数据出境。
  • 境外收集产生的个人信息传至境内处理后向境外提供，且处理过程未引入境内个人信息或重要数据。
  • 为订立、履行个人作为一方当事人的合同所必需（跨境购物、寄递、汇款、支付、开户、票务、签证、考试等）。
  • 依照依法制定的劳动规章制度和集体合同实施的跨境人力资源管理。
  • 紧急情况下为保护自然人生命健康和财产安全所必需。
  • 非 CIIO 处理者一年内累计出境不满 10 万人非敏感个人信息。

对许多外资企业而言，经仔细梳理后，多数常规出境流都落入这些豁免，只有高体量与重要数据流需要走评估。

自贸试验区负面清单的”切口”

依 2024 年规定，自由贸易试验区可在国家数据分类分级保护框架下，自行制定区内仍需纳入评估、标准合同或认证管理的数据清单（负面清单）。清单经省级网信委批准并报国家网信部门、数据管理部门备案后，清单之外的数据在区内出境即可免予三种机制。2026 年《利用外资固稳促优行动方案》鼓励自贸试验区与服务业扩大开放试点城市扩大场景化、字段级负面清单，因此这一实际”切口”正在拓宽。

程序分步

  1. 风险自评估。 申报前，处理者须开展并记录数据出境风险自评估，涵盖目的、范围与必要性；数据规模、类型与敏感程度；境外接收方保障能力；出境后风险；以及与接收方法律文件中的保护约定。
  2. 向省级网信部门申报。 提交申报书、自评估报告、与境外接收方的法律文件及支撑材料；省级网信部门 5 个工作日内完成完备性查验，材料齐全则报送国家网信部门。
  3. 受理。 国家网信部门收到齐全材料后 7 个工作日内决定是否受理。
  4. 评估。 国家网信部门在 45 个工作日内组织评估（情况复杂或需补正的，可延长），综合研判国家安全与公共利益风险、接收方所在国法律环境、数据规模与敏感程度及保障措施充分性。
  5. 结果及有效期。 书面结果自出具之日起有效期 2 年。2024 年规定新增了有效期届满前申请延长的明确路径；若目的、范围、类型、接收方或法律环境发生重大变化，须重新申报。

外资企业的实操要点

  • 盘点与分类。 建立数据地图：持有何种数据、来源、境外接收方是谁、是否构成”重要数据”（注意：在所属行业未公布重要数据目录前，一般不推定持有）。
  • 对照阈值。 按自然年统计个人信息主体数量，并确认是否具 CIIO 身份（通常由行业主管部门认定）。
  • 优先适用豁免。 将常规人力资源、合同履行及阈值以下流通过豁免处理，使其不进入评估管道。
  • 备好法律文件。 与接收方的合同或具有法律效力的文件须明确目的、范围、保存期限、再转移限制、安全措施与违约救济。
  • 走线上系统。 通过国家数据出境系统 sjcj.cac.gov.cn 申报与跟踪，并按第三版指南的材料清单准备。
  • 规划续期。 若出境业务持续，务必在 2 年届满前提前设置提醒，申请延长。

须把握的边界

安全评估并非快速通道，应预留 2–3 个月前置时间。结果绑定于所申报的数据范围与接收方——新的使用场景或接收方控制权重大变化将触发重新评估。三条通道是”择一适用”而非叠加：按事实选择所需通道，而非层层叠加。

相关阅读可参见本站的”标准合同出境””个人信息出境认证”与”字段级数据出境负面清单”等文章。

Sources

Data Export / 数据出境

Cross-Border Transfer of Personal Information via the China Standard Contract: Thresholds, Filing and Model Clauses

  • The standard contract is the second of PIPL’s three export routes: sign with the overseas recipient, then file with the provincial cyberspace administration.
    标准合同是《个保法》三条出境路径中的第二条：与境外接收方签约，再向省级网信部门备案。
  • Eligibility is fixed by volume bands: non-CIIO, 100k–under 1m non-sensitive or under 10k sensitive individuals, and no important data.
    适用以数量区间为界：非CIIO、10万至不满100万人非敏感或不满1万人敏感个人信息，且不含重要数据。
  • Splitting volumes to dodge the security assessment is expressly prohibited and is judged at group level.
    明令禁止以数量拆分规避安全评估，且按集团合并口径认定。
  • Separate consent and a five-point PIPIA are mandatory prerequisites before the contract takes effect.
    合同生效前须取得单独同意并完成涵盖五项重点的个人信息保护影响评估。
  • Filing is within 10 working days of the contract taking effect, with the PIPIA report and a cross-border description attached.
    备案须在合同生效之日起10个工作日内完成，附影响评估报告与出境说明。
  • The contract runs for its term and lapses if the handler no longer meets the bands or the data drift outside scope.
    合同随期限有效，若处理者不再符合区间或数据超出范围即失效。

Cross-Border Transfer of Personal Information via the China Standard Contract: Thresholds, Filing and Model Clauses | 通过标准合同出境个人信息：阈值、备案与合同范本实务

The Second Route and Where It Sits

Article 38 of the Personal Information Protection Law (PIPL) sets out three lawful routes to export personal information: (1) a security assessment organised by the national cyberspace administration (CAC); (2) personal information protection certification; and (3) concluding and filing a standard contract with the overseas recipient. The *Measures for the Standard Contract for Outbound Provision of Personal Information* (CAC Order No. 13, effective 1 June 2023) operationalise route (3). The standard contract is the lightest of the three in terms of upfront gatekeeping—no CAC declaration, no accredited body—but it is available only within tight volume bands and still demands a real compliance file.

Who Qualifies: the Volume Bands

A handler may use the standard contract only if all of the following hold at once:

  • it is not a critical information infrastructure operator (CIIO);
  • counting cumulatively from 1 January of the current year, it provides abroad the personal information of 100,000 or more but fewer than 1,000,000 individuals, excluding sensitive personal information, or the sensitive personal information of fewer than 10,000 individuals;
  • the exported personal information does not include important data.

The count resets each 1 January. A fast-growing platform, SaaS or e-commerce business can fall out of the band mid-year, at which point the security assessment route becomes mandatory.

The Anti-Splitting Rule

Handlers may not use quantity-splitting or similar devices to route, via the standard contract, personal information that should lawfully undergo a security assessment. A group with several China entities feeding one overseas parent should assume the aggregate flow is what the regulator counts. Structuring entities or contracts to stay “just under” a threshold is precisely the conduct the rule targets.

Before You Sign: Consent and the Five-Point PIPIA

Before the standard contract takes effect, the handler must have given the statutory notification, obtained separate consent from the individuals, and carried out a personal information protection impact assessment (PIPIA) examining:

  1. Whether the handler’s and recipient’s processing purposes, scope and methods are lawful, legitimate and necessary.
  2. The scale, scope, type and sensitivity of the exported information and the risks to national security, the public interest and individual rights.
  3. Whether the obligations the recipient undertakes and its management and technical measures can safeguard security.
  4. The risk of the information being altered, destroyed, leaked, lost or unlawfully used after export, and whether rights-upholding channels remain open.
  5. The effect of the recipient’s country or region’s personal-information policies and laws on security and individual rights.

The PIPIA report must be kept for at least three years.

Filing: Timing and Materials

The standard contract must follow the annexed model strictly; the parties may add terms that do not conflict with it. The contract takes effect before any export begins. Within 10 working days of the contract taking effect, the handler files with the provincial cyberspace administration where it is located, submitting: (1) the signed standard contract; (2) the PIPIA report; and (3) a description of the outbound provision. The CAC’s filing guide (first edition) sets out the method, process and materials in detail. Where circumstances change—new recipient, new purpose, new sensitive categories—the handler must re-run the PIPIA, supplement or re-execute the contract, and re-file.

What the Model Clauses Actually Require

The annexed model allocates obligations: the handler must inform individuals of the recipient’s name, contacts, purposes, types of personal information, methods, individual rights and the complaint channel; the overseas recipient must perform the contract, accept individual rights requests, and cooperate with supervision. It also fixes the governing-law and dispute-resolution expectations and includes appendices—a description of the outbound provision and any separately agreed terms. The contract is the evidentiary core of the route: if the file is thin, the export is exposed even when the volume band is satisfied.

Standard Contract Against the Other Two Routes

RouteTriggerGatekeeping stepValidityUsers
Security assessmentCIIO exports, important data, or volumes above the bandCAC declaration and assessmentPer that regimeAny handler triggering it
CertificationNon-CIIO; 100k–<1m non-sensitive or <10k sensitive; no important dataAccredited body audit plus supervision3 yearsVoluntary, non-CIIO
Standard contractSame bands as certificationContract signed, filed with provincial CACContract termNon-CIIO

Practical Steps for a Foreign-Invested Enterprise

  1. Count first, tracking cumulative exports from 1 January and separating sensitive from non-sensitive data.
  2. Rule out important data and CIIO status before assuming the contract is available.
  3. Consolidate group flows; the anti-splitting rule bites at group level.
  4. Fix the consent stack and run the PIPIA against the five points, especially the recipient jurisdiction’s legal regime.
  5. Sign, then file within 10 working days, keeping the PIPIA report for three years and re-filing on material change.

Related Reading

See our PIPL cross-border transfer overview (No. 35), the field-level data export negative list (No. 57) and the third route—PI export certification (No. 174).

通过标准合同出境个人信息：阈值、备案与合同范本实务

第二条路径及其定位

《个人信息保护法》第三十八条列出三条合法出境路径：（1）国家网信部门组织的出境安全评估；（2）个人信息保护认证；（3）与境外接收方订立标准合同并备案。《个人信息出境标准合同办法》（国家网信办令第13号，2023年6月1日施行）落地第（3）项。标准合同是三条路径中事前门槛最轻的——无需向网信部门申报评估，也无需有资质机构——但仅在严格数量区间内可用，且仍须具备真实合规档案。

适用条件：数量区间

处理者使用标准合同须同时满足以下全部条件：

  • 属于非关键信息基础设施运营者（非CIIO）；
  • 自当年1月1日起累计向境外提供10万人以上、不满100万人个人信息（不含敏感个人信息），或者不满1万人敏感个人信息；
  • 出境个人信息不包括重要数据。

累计数每年1月1日重新起算。快速增长的平台、SaaS或电商业务可能年中越出区间，届时须改走安全评估路径。

反规避条款

处理者不得采取数量拆分等手段，将依法应当通过出境安全评估的个人信息经标准合同出境。多家中国主体向同一境外母公司回传数据的集团，应默认监管看合并总量。为”压线”而拆分主体或合同，正是该条款所针对的行为。

签约前：同意与五项重点影响评估

标准合同生效前，处理者必须已依法履行告知义务、取得个人单独同意，并开展个人信息保护影响评估（PIPIA），重点评估：

  1. 处理者与境外接收方处理目的、范围、方式的合法性、正当性、必要性；
  2. 出境信息的规模、范围、种类、敏感程度及其对国家安全、公共利益、个人信息权益的风险；
  3. 境外接收方承诺承担的义务及其管理和技术措施能否保障安全；
  4. 出境后信息遭篡改、破坏、泄露、丢失、非法利用的风险，以及权益维护渠道是否通畅；
  5. 境外接收方所在国家或地区个人信息保护政策法规对安全与权益的影响。

影响评估报告须至少保存三年。

备案：时限与材料

标准合同须严格按附件范本订立，双方可约定不与范本冲突的其他条款。合同生效后方可开展出境。合同生效之日起10个工作日内，处理者向所在地省级网信部门备案，提交：（1）已签署的标准合同；（2）影响评估报告；（3）出境说明。网信办《备案指南（第一版）》对方式、流程与材料作出具体说明。情形变更——新接收方、新目的、新增敏感类别——须重新评估、补充或重订合同并重新备案。

范本条款究竟要求什么

附件范本分配了双方义务：处理者须告知个人接收方名称、联系方式、目的、个人信息种类、方式、个人权利及投诉渠道；境外接收方须履行合同、响应个人权利请求并配合监管。范本还约定了准据法与争议解决预期，并含两份附录——出境说明与另行约定条款。合同是本条路径的证据核心：即便数量区间满足，档案单薄仍会使出境暴露风险。

标准合同与另两条路径对比

路径触发阈值主管环节有效期适用主体
出境安全评估CIIO出境、含重要数据或超出合同区间向网信部门申报评估依该制度触发任一条件者
个人信息保护认证非CIIO；10万至不满100万人非敏感或不满1万人敏感；不含重要数据有资质机构认证并持续监督3年自愿的非CIIO
标准合同备案与认证相同区间签约并向省级网信部门备案合同期限非CIIO

外资企业的实操步骤

  1. 先做计数：自1月1日起跟踪累计出境量，区分敏感与非敏感数据。
  2. 先排除重要数据与CIIO身份，再判断标准合同是否可用。
  3. 合并集团数据流，反规避条款在集团层面生效。
  4. 修好同意链路并开展影响评估，尤其是接收方所在法域的法律制度评估。
  5. 签约后10个工作日内备案，影响评估报告保存三年，重大变更重新备案。

延伸阅读

可参阅本站PIPL跨境传输总览（编号35）、字段级数据出境负面清单（编号57）与第三条路径——个人信息出境认证（编号174）。

Sources

Data Export / 数据出境

China’s Personal Information Export Certification: The Third Route Opens on 1 January 2026

  • China’s third data-export route opened on 1 January 2026 under CAC and SAMR Order No. 20.
    第20号令使个人信息保护认证成为可用通道，2026年1月1日起施行。
  • Eligibility is narrow: non-CIIO handlers, 100,000 to under 1m individuals’ non-sensitive data or under 10,000 individuals’ sensitive data, and no important data.
    适用面窄：非CIIO主体，10万至不满100万人非敏感或不满1万人敏感个人信息，且不含重要数据。
  • Splitting volumes to dodge the security assessment is expressly prohibited.
    明令禁止以数量拆分等手段规避应当进行的出境安全评估。
  • Notification, separate consent and a five-point impact assessment must be completed before applying.
    申请前须完成告知、取得单独同意，并开展涵盖五项法定重点的个人信息保护影响评估。
  • Certificates run three years and may be suspended or revoked if exports drift outside the certified scope.
    证书有效期三年；出境情况与认证范围不一致的，可被暂停直至撤销。
  • The route is voluntary and market-based: an extra compliance option, not a new obligation.
    该路径自愿、市场化，是增加的合规选择而非新增义务。

China’s Personal Information Export Certification: The Third Route Opens on 1 January 2026 | 个人信息出境认证办法：2026年1月1日起启用的第三条数据出境通道

Three Routes Out, and What Order No. 20 Changes

Article 38(1) of the Personal Information Protection Law (PIPL) gives three lawful export routes: (1) a security assessment organised by the national cyberspace administration (CAC); (2) personal information protection certification; and (3) concluding and filing the standard contract with the overseas recipient. Route (2) long existed mainly at the level of the rule — no accredited bodies, no clear criteria — so it was almost never used. The *Measures for Personal Information Export Certification*, Order No. 20 of the CAC and the State Administration for Market Regulation (SAMR), promulgated on 14 October 2025 and effective 1 January 2026, change that. Drawing on the PIPL, the Regulations on Network Data Security Management and the Regulations on Certification and Accreditation, they supply the missing institutions, thresholds, application path, certificate and supervision cycle.

Who Qualifies: Eligibility and Volume Bands

A handler must satisfy all of the following at once:

  • it is not a critical information infrastructure operator (CIIO);
  • counting cumulatively from 1 January of the current year, it has provided abroad the personal information of 100,000 or more but fewer than 1,000,000 individuals, excluding sensitive personal information, or the sensitive personal information of fewer than 10,000 individuals;
  • the exported personal information does not include important data.

The count resets each 1 January, so a fast-growing business can exit the band mid-year; watch the running total.

The Anti-Splitting Rule

Handlers may not use quantity-splitting or similar devices to route through certification personal information that should lawfully undergo the security assessment. Groups with several Chinese entities feeding one overseas parent should assume the aggregate flow is what counts.

Before You Apply: Consent and the Five-Point PIPIA

Before filing, the handler must have given the statutory notification, obtained separate consent, and carried out a personal information protection impact assessment (PIPIA), which must examine:

  1. Whether the handler’s and the recipient’s processing purposes, scope and methods are lawful, legitimate and necessary.
  2. The scale, scope, type and sensitivity of the exported information and the risks to national security, the public interest and individual rights.
  3. Whether the obligations the recipient undertakes to bear, and its management and technical measures and capabilities, can safeguard security.
  4. The risk of the information being altered, destroyed, leaked, lost or unlawfully used after export, and whether channels for upholding individual rights remain unobstructed.
  5. The effect of the personal information protection policies and laws of the recipient’s country or region on information security and individual rights.

Who Certifies, and What the Certificate Is Worth

Certification is carried out by professional certification bodies holding personal information protection certification accreditation, applying the certification basic norms and the certification rules. A certificate is valid for three years and must be reported to the National Certification and Accreditation Information Public Service Platform. Supervision continues: where exports are inconsistent with the certified scope, or the handler no longer meets the requirements, the body must suspend the certificate until revocation; where exports breach the law, it must report promptly to the CAC and other competent authorities.

Who Regulates Whom

The CAC, with the national data administration and other departments, sets the standards and technical specifications. The market regulation department, with the CAC, sets the certification rules and the unified certificate and mark. A body must file with the CAC within 10 working days of accreditation. Departments at provincial level or above may summon a certified handler whose exports present significant risk or that suffers a personal information security incident.

Certification Against the Other Two Routes

RouteTriggerGatekeeping stepValidityUsers
Security assessmentCIIO exports, important data, or volumes above the bandCAC declaration and assessmentPer that regimeAny handler triggering it
CertificationNon-CIIO; 100k–<1m non-sensitive or <10k sensitive; no important dataAccredited body audit plus supervision3 yearsVoluntary, non-CIIO
Standard contractSame bands as certificationContract signed, filed with provincial CACContract termNon-CIIO

Tsinghua law professor Shen Weixing explains why a private audit can be a lawful basis: certification packages the required safeguards as third-party review, continuing supervision, and remedies enforceable by data subjects. Wang Zhicheng of the CAC’s Data and Technology Support Centre notes the voluntary, market-based design lightens regulators’ load and widens compliance choices; Ding Xiaodong of Renmin University’s Law School sees the Measures as completing China’s export system. (Expert views.)

The Wider 2026 Data-Flow Liberalisation

The *Action Plan for Stabilising and Optimising the Use of Foreign Investment* (Shang Zi Fa [2026] No. 97), issued by MOFCOM, the NDRC and the Ministry of Finance on 16 June 2026, supports free trade zones and services-opening pilot cities in exploring scenario-based, field-level data export negative lists, and pushes for national standards for important-data identification catalogues in industry, telecommunications, geographic information, automotive, pharmaceuticals, seed industry, aerospace and civil aviation. Beijing and Guangdong have already issued FTZ negative lists through joint three-department notices.

Practical Steps for a Foreign-Invested Enterprise

  1. Count first, tracking cumulative exports from 1 January and separating sensitive from non-sensitive data.
  2. Rule out important data and CIIO status before assuming certification is available.
  3. Consolidate group flows; the anti-splitting rule bites at group level.
  4. Fix the consent stack and run the PIPIA against the five points, especially the recipient jurisdiction’s legal regime.
  5. Select an accredited body, verify its CAC filing, and monitor scope drift.

Related Reading

See our PIPL cross-border transfer overview and our field-level data export negative list article.

个人信息出境认证办法：2026年1月1日起启用的第三条数据出境通道

三条出境通道与第20号令的改变

《个人信息保护法》第三十八条第一款规定三条合法出境路径：（1）国家网信部门组织的出境安全评估；（2）个人信息保护认证；（3）与境外接收方按标准合同签约并备案。第（2）项长期停留在规定层面——机构资质稀缺、细则不明，企业极少采用。《个人信息出境认证办法》由国家互联网信息办公室、国家市场监督管理总局以第20号令于2025年10月14日公布，自2026年1月1日起施行，上位法为《个人信息保护法》《网络数据安全管理条例》《认证认可条例》，补齐了机构、门槛、申请路径、证书与持续监督等缺失环节。

适用条件与数量区间

处理者须同时满足以下全部条件：

  • 属于非关键信息基础设施运营者（非CIIO）；
  • 自当年1月1日起累计向境外提供10万人以上、不满100万人个人信息（不含敏感个人信息），或者不满1万人敏感个人信息；
  • 出境个人信息不包括重要数据。

累计数每年1月1日重新起算，快速增长的电商或SaaS业务可能年中越出区间，应盯住滚动累计值。

反规避条款

处理者不得采取数量拆分等手段，将依法应当通过出境安全评估的个人信息通过认证方式出境。多家中国主体向同一境外母公司回传数据的集团，应默认监管看合并总量。

申请前：同意与五项重点影响评估

申请前，处理者必须已依法履行告知义务、取得单独同意，并开展个人信息保护影响评估（PIPIA），重点评估：

  1. 处理者与境外接收方处理个人信息的目的、范围、方式的合法性、正当性、必要性；
  2. 出境个人信息的规模、范围、种类、敏感程度，及其对国家安全、公共利益、个人信息权益的风险；
  3. 境外接收方承诺承担的义务及其管理和技术措施、能力能否保障安全；
  4. 个人信息出境后遭篡改、破坏、泄露、丢失、非法利用的风险，以及权益维护渠道是否通畅；
  5. 境外接收方所在国家或地区的个人信息保护政策法规对出境信息安全与个人权益的影响。

由谁认证，证书意味着什么

认证由依法取得个人信息保护认证资质的专业认证机构实施，依据认证基本规范、个人信息保护认证规则开展。证书有效期3年，机构应向全国认证认可信息公共服务平台报送证书信息。监督持续：获证处理者出境情况与认证范围不一致或不再符合认证要求的，机构应暂停其使用直至撤销证书；出境活动违反法律法规的，应及时向国家网信部门和有关部门报告。

监管架构

国家网信部门会同国家数据管理部门等制定认证相关标准、技术规范；国家市场监督管理部门会同国家网信部门制定个人信息保护认证规则、统一认证证书及标志。专业认证机构自取得资质之日起10个工作日内向国家网信部门备案。省级以上网信部门等发现获证处理者出境活动存在较大风险或发生个人信息安全事件的，可依法约谈。

三条路径对比

路径触发阈值主管环节有效期适用主体
出境安全评估CIIO出境、含重要数据或超出认证区间向网信部门申报评估依该制度触发任一条件者
个人信息保护认证非CIIO；10万至不满100万人非敏感或不满1万人敏感；不含重要数据有资质机构认证并持续监督3年自愿的非CIIO
标准合同备案与认证相同区间签约并向省级网信部门备案合同期限非CIIO

清华大学法学院教授申卫星解释第三方审核何以构成合法依据：认证把适当保障具体化为”经第三方审核＋持续监督＋对数据主体可执行的承诺与救济”。国家网信办数据与技术保障中心副主任王志成指出，自愿性、市场化、社会化服务设计既减轻监管负担，也赋予企业更多合规选择权；中国人民大学法学院副院长丁晓东认为，《办法》标志我国个人信息出境制度体系已构建完成。（专家观点。）

2026年更广的数据流动松绑

商务部、国家发展改革委、财政部《利用外资固稳促优行动方案》（商资发〔2026〕97号，2026年6月16日印发）明确：支持自由贸易试验区、国家服务业扩大开放试点城市探索在更多领域制定场景化、字段级数据出境负面清单，推动制定工业、电信、地理信息、汽车、医药、种业、航天、民航等行业领域重要数据识别目录国家标准。北京、广东已由地方三部门联合印发自贸试验区数据出境负面清单及管理办法。

外资企业的实操步骤

  1. 先做计数：自1月1日起跟踪累计出境量，区分敏感与非敏感数据。
  2. 先排除重要数据与CIIO身份，再判断认证是否可用。
  3. 合并集团数据流，反规避条款在集团层面生效。
  4. 修好同意链路并开展影响评估，尤其是接收方所在法域的法律制度评估。
  5. 选择有资质机构并核验其网信备案，同时监控认证范围漂移。

延伸阅读

可参阅本站PIPL跨境传输总览，以及字段级数据出境负面清单一文。

Sources

E-commerce Entry / 电商入华

Telecom sector opening to foreign investment: the value-added services pilot

  • China has removed foreign-equity caps on internet data centre (IDC) and other value-added telecom services in Beijing, Shanghai, Hainan and Shenzhen.
    中国已在北京、上海、海南、深圳取消互联网数据中心（IDC）等增值电信业务的外资股比限制。
  • As of June 2026, 166 foreign-invested enterprises had received value-added telecom operating pilot approvals since the first batch in February 2025.
    截至2026年6月，自2025年2月首批以来，已有166家外商投资企业获得增值电信业务经营试点批复。
  • Foreign-invested telecom enterprises in China now exceed 3,100, covering all 10 categories of value-added telecom services.
    中国外商投资电信企业数量已超过3100家，覆盖《电信业务分类目录》全部10类增值电信业务。
  • Pilot firms may legally operate IDC, internet access (ISP) and information services for foreign investors.
    试点企业可依法经营互联网数据中心、互联网接入服务（ISP）及信息服务等面向外资的业务。
  • The opening reflects deeper telecom-sector liberalisation under the 15th Five-Year Plan.
    此次开放体现了”十五五”规划下电信领域更深层次的自由化。

Telecom sector opening to foreign investment: the value-added services pilot | 电信领域扩大开放：增值电信业务外资试点

Overview

On 3 June 2026, the Ministry of Industry and Information Technology (MIIT) confirmed a major milestone in China’s telecom-sector liberalisation: since the first batch of value-added telecom operating pilot approvals in February 2025, 166 foreign-invested enterprises have received approvals to operate under the expanded-opening pilot. These firms may now legally provide internet data centre (IDC), internet access service (ISP), information services and related value-added telecom services in designated pilot regions.

The move stems from the 2024 policy notice 《关于开展增值电信业务扩大对外开放试点工作的通告》 (Announcement on Piloting the Expansion of Opening-Up of Value-Added Telecom Services), issued in April 2024, which authorised the removal of foreign-equity caps on IDC and other value-added services in Beijing, Shanghai, Hainan and Shenzhen. For foreign investors, this is the first time a genuinely level playing field has opened in infrastructure-heavy telecom segments that were previously ring-fenced for domestic capital.

What changed: the pilot scope

The pilot removes the long-standing requirement that value-added telecom operators be majority Chinese-owned in the following categories:

  • Internet Data Centre (IDC) — colocation, hosting, cloud infrastructure services.
  • Internet Access Service (ISP) — last-mile and backbone connectivity resale.
  • Information Services — content platforms, app stores, paid information services.
  • Other value-added categories — as enumerated in the Telecom Business Classification Catalogue.

Prior to the pilot, foreign investors could only hold a minority stake (typically capped at 50%) in most value-added segments, and IDC was effectively closed. The 2024 notice and its 2025–2026 implementation phases lift these caps entirely within the four pilot regions, allowing 100% foreign-owned entities to apply for operating licences.

Approval numbers and market scale

The figures published by MIIT on 3 June 2026 provide a clear picture of momentum:

MetricFigureNote
Pilot approvals since Feb 2025166 enterprisesFirst batch issued Feb 2025
Foreign-invested telecom enterprises nationwide>3,100All 10 value-added categories covered
Pilot regions4 (Beijing, Shanghai, Hainan, Shenzhen)Foreign-equity caps removed
Policy basis2024-04 noticeExpanded opening pilot

The nationwide base of more than 3,100 foreign-invested telecom enterprises is significant: it means foreign capital already participates across the full spectrum of the Telecom Business Classification Catalogue’s ten value-added categories, even outside the four pilot regions where equity limits still apply in some segments.

Why this matters for market entry

For foreign technology and internet firms evaluating China entry, the pilot removes two historical obstacles:

  1. Equity control. A 100% foreign-owned subsidiary can now hold the licence directly, removing the need for a domestic joint-venture partner in IDC, ISP and information services within pilot regions.
  2. Service scope. Licensed pilot firms may offer cloud, hosting, connectivity and content services to their own group entities and third parties, enabling genuine local infrastructure footprints.

This is particularly relevant to e-commerce and digital-economy operators that require in-country data hosting, low-latency connectivity and compliant content delivery. Establishing a wholly foreign-owned IDC/ISP entity in Shanghai or Shenzhen can now be a viable alternative to relying on a domestic partner.

Practical steps to obtain a pilot licence

Foreign investors generally follow this path:

  • Confirm eligibility. The applicant must be a foreign-invested enterprise incorporated in one of the four pilot regions, or establish a local subsidiary there.
  • Prepare technical and security filings. IDC/ISP licences require network security, data-localisation and real-name verification compliance packages.
  • Apply through MIIT and the provincial communications administration. The pilot approval is coordinated between central and provincial regulators.
  • Maintain ongoing compliance. Annual inspections, cybersecurity graded protection (等保) and content supervision apply.

Legal and regulatory advisers should be engaged early, as the security and data-compliance thresholds for IDC/ISP are higher than for ordinary value-added services.

Strategic context

The expansion is consistent with China’s broader services-opening agenda and the 15th Five-Year Plan’s emphasis on a high-standard open economy. Telecom infrastructure is a foundational input for nearly every digital business, so liberalising it lowers the cost of China operations for foreign groups and signals regulatory confidence in managed opening.

Investors should still monitor that the pilot remains confined to four regions and that equity caps persist elsewhere. A gradual national rollout is plausible but not yet committed.

Sources

  • State Council / Xinhua (gov.cn) — MIIT briefing, 2026-06-03: 166 pilot approvals, 3,100+ foreign-invested telecom enterprises.
  • CCTV — 2026-06-03 report on value-added telecom opening progress.
  • Central Government Portal (gov.cn) — 《关于开展增值电信业务扩大对外开放试点工作的通告》(2024-04), policy basis for the pilot.

电信领域扩大开放：增值电信业务外资试点

概述

2026年6月3日，工业和信息化部（工信部）确认了中国电信领域自由化的一项重要里程碑：自2025年2月首批增值电信业务经营试点批复以来，已有166家外商投资企业获得批复，可在指定试点地区依法经营互联网数据中心（IDC）、互联网接入服务（ISP）、信息服务等增值电信业务。

此举源于2024年4月发布的《关于开展增值电信业务扩大对外开放试点工作的通告》。该通告授权在北京、上海、海南、深圳取消IDC等增值电信业务的外资股比限制。对外国投资者而言，这是首次在以往被本土资本保护的基础设施型电信业务领域，真正打开了公平竞争的通道。

试点范围的变化

试点取消了长期以来对外资增值电信运营商须由中方控股的要求，涵盖以下类别：

  • 互联网数据中心（IDC）——机柜托管、主机租用、云基础设施服务。
  • 互联网接入服务（ISP）——最后一公里及骨干带宽转售。
  • 信息服务——内容平台、应用商店、有偿信息服务。
  • 其他增值电信类别——以《电信业务分类目录》列明的为准。

在试点之前，外资在大多数增值电信业务中的持股通常受限（一般上限50%），而IDC业务实际上对外资关闭。2024年的通告及其2025—2026年的实施阶段，在四个试点地区完全取消了上述股比限制，允许设立100%外商独资企业申请经营许可证。

批复数量与市场规模

工信部于2026年6月3日公布的数据清晰展现了开放节奏：

指标数值说明
2025年2月以来试点批复166家企业首批于2025年2月发放
全国外商投资电信企业3,100余家覆盖全部10类增值电信业务
试点地区4个（北京、上海、海南、深圳）取消外资股比限制
政策依据2024-04通告扩大开放试点

全国范围内超过3,100家外商投资电信企业这一基数意义重大：它意味着即使在四个试点地区之外、部分业务仍存在股比限制的情况下，外资已参与到《电信业务分类目录》全部十类增值电信业务中。

对市场准入的意义

对于评估来华路径的外国科技与互联网企业，试点消除了两大历史障碍：

  1. 股权控制。 在试点地区，外商独资企业可直接持有牌照，无需为IDC、ISP及信息服务业务设立中方合资伙伴。
  2. 业务范围。 持牌试点企业可向集团内部及第三方提供云、托管、连接与内容服务，从而建立真正的本地基础设施布局。

这对需要境内数据托管、低时延连接与合规内容分发的电商及数字经济运营商尤为关键。在上海或深圳设立100%外资控股的IDC/ISP实体，如今可作为依赖本土合作伙伴的可行替代方案。

申请试点牌照的实操步骤

外商投资企业通常遵循以下路径：

  • 确认资格。 申请人须为在四个试点地区之一设立的外商投资企业，或在该地设立本地子公司。
  • 准备技术与安全申报材料。 IDC/ISP牌照要求提交网络安全、数据本地化及实名验证等合规文件包。
  • 通过工信部及省级通信管理局申请。 试点批复由中央与省级监管协同推进。
  • 维持持续合规。 需接受年度检查、网络安全等级保护（等保）及内容监管。

由于IDC/ISP的安全与数据合规门槛高于一般增值业务，建议尽早聘请法律与监管顾问。

战略背景

此次扩大开放与中国更广泛的服务业开放议程，以及”十五五”规划对高标准开放型经济的强调相一致。电信基础设施几乎是所有数字业务的基础投入，其自由化降低了外国集团在华运营的成本，也释放出对”有管理的开放”的监管信心。

投资者仍应留意：试点目前仅限四个地区，其余地区股比限制依然存在。逐步向全国推广虽有可能，但尚未明确承诺。

来源

E-commerce Entry / 电商入华

Telecom VAS Liberalization Reaches 166 Foreign-Funded Approvals: A Milestone in China’s Services Opening

  • China’s telecom value-added services (VAS) liberalization has reached 166 foreign-funded pilot approvals as of the first half of 2026. 截至 2026 年上半年，增值电信业务扩大开放试点已向 166 家外资企业发放批复。
  • The Ministry of Industry and Information Technology (MIIT) runs the pilot in Beijing, Shanghai, Hainan, and Shenzhen. 工业和信息化部在北京、上海、海南、深圳四地实施增值电信业务扩大对外开放试点。
  • The first batch of 13 foreign-funded enterprises received approvals in February 2025 across the four pilot cities. 首批 13 家外资企业试点批复于 2025 年 2 月发放，覆盖北京、上海、海南、深圳。
  • Nationwide foreign-invested telecom enterprises total 3,219, up 23.9% year-on-year, now covering all 10 VAS categories. 全国外商投资电信企业累计达 3219 家，同比增长 23.9%，经营范围已覆盖全部 10 项增值电信业务。
  • Foreign firms may operate internet access, online data processing and transaction processing, and information services. 外资企业可开展互联网接入服务、在线数据处理与交易处理、信息服务等增值电信业务。
  • A State Council Information Office briefing on 20 July 2026 reported telecom business volume up 7.9% year-on-year in H1 2026. 国新办 2026 年 7 月 20 日新闻发布会介绍，上半年电信业务总量同比增长 7.9%。
  • The sector has entered a new phase of institutional opening with full-business coverage and transparent rules. 这标志着我国电信业从局部渐进探索迈入全业务覆盖、规则透明的制度型开放新阶段。

Telecom VAS Liberalization Reaches 166 Foreign-Funded Approvals: A Milestone in China’s Services Opening | 增值电信业务扩大开放累计 166 家外资获批：服务业开放里程碑

Overview

China’s opening of its telecom value-added services (VAS) sector to foreign investment has reached a new milestone. According to the Ministry of Industry and Information Technology (MIIT), by the first half of 2026 the pilot program for expanding opening in telecom value-added services had granted approvals to 166 foreign-funded enterprises. This development marks a decisive shift: the country’s telecom sector has moved from localized, incremental exploration into a new phase of institutional opening characterized by full-business coverage and transparent rules.

The pilot is led by MIIT and implemented in four locations—Beijing, Shanghai, Hainan, and Shenzhen. These cities were selected as the testing ground for wider foreign participation in a sector long subject to ownership and market-access restrictions. The expansion builds on a clear policy trajectory in which China has progressively widened market access for foreign investors in services, with telecom VAS positioned as a strategically important yet lower-risk entry point relative to basic telecom services.

Pilot rollout

The pilot began in earnest in February 2025, when the first batch of 13 foreign-funded enterprises received pilot approvals across the four designated cities—Beijing, Shanghai, Hainan, and Shenzhen. That initial tranche established the administrative template: foreign applicants submit to the local communications authority, which reviews against the pilot scope and forwards qualified cases to MIIT for the formal pilot approval.

From those first 13 approvals in early 2025, the cumulative count climbed steadily through the year and into 2026. By the first half of 2026, the total had reached 166 foreign-funded pilot approvals. The acceleration reflects both rising foreign appetite and the maturing of the review and approval process, which has become more predictable as precedents accumulate.

Scale of opening

The aggregate picture underscores the breadth of the opening. As of the first half of 2026, nationwide foreign-invested telecom enterprises totaled 3,219, up 23.9% compared with the same period last year. Critically, the business scope of these enterprises now covers all 10 value-added telecom service categories listed in the Telecom Business Classification Catalogue. This is the first time the full set of VAS categories has been reachable by foreign-invested operators under the pilot framework.

The State Council Information Office (SCIO) press conference on 20 July 2026, reviewing industrial and information technology development in the first half of 2026, reported that total telecom business volume grew 7.9% year-on-year and that the level of openness in the telecom sector continued to rise steadily. The figures provide official confirmation that opening has been accompanied by healthy sector growth rather than disruption.

Covered services

Under the pilot, foreign-funded enterprises may engage in a defined set of value-added telecom services. The core permitted activities include:

  • Internet access services — provision of internet connectivity to end users and enterprises.
  • Online data processing and transaction processing — platforms that handle data exchange and support e-commerce and transaction settlement.
  • Information services — content and information delivery services, including application stores, information publishing, and related value-added offerings.

These categories sit within the broader 10-category VAS framework of the Telecom Business Classification Catalogue. Foreign investors entering through the pilot are expected to operate within the approved scope and to comply with China’s cybersecurity, data, and content regulations, which apply equally to domestic and foreign operators.

How foreign firms apply

Foreign investors interested in the pilot generally follow a structured path:

  1. Choose a pilot location. Establish or designate a presence in one of the four pilot cities—Beijing, Shanghai, Hainan, or Shenzhen—as the pilot operating base.
  2. Confirm eligible business scope. Map the intended services to the permitted VAS categories (internet access, online data processing and transaction processing, information services, and others within the pilot scope).
  3. Submit to the local communications authority. File the pilot application with the provincial or municipal communications administration in the chosen city, including corporate, technical, and compliance documentation.
  4. MIIT pilot approval. The local authority reviews and, for qualified cases, escalates to MIIT, which issues the formal pilot approval for value-added telecom operations.
  5. Operate within scope. Upon approval, the enterprise conducts the approved VAS within the pilot region while meeting ongoing regulatory and reporting obligations.

Practical timelines vary by case complexity and completeness of filings, but the accumulation of 166 approvals indicates a workable, repeatable process rather than a one-off exercise.

Practical notes

For foreign entrants, several points merit attention. First, the pilot remains geographically bounded to the four cities; operations outside them require separate authorization. Second, the full 10-category coverage refers to the aggregate national picture—an individual approval still defines the specific categories a given enterprise may run. Third, foreign operators remain fully subject to China’s data security, personal-information protection, and content supervision regimes. Finally, the steady 23.9% year-on-year growth in foreign-invested telecom enterprises signals a receptive environment, but success still depends on local partnerships, compliance readiness, and a clear service proposition.

Related reading

  • MIIT’s official portal publishes the governing notices and the list of approved pilot enterprises.
  • The People’s Posts and Telecommunications News coverage of the 20 July 2026 SCIO briefing details the “acceleration” of telecom-sector opening in the first half of 2026.
  • MIIT reporting on the first Beijing approvals in February 2025 documents the opening of the pilot to four foreign-funded enterprises in the capital.

增值电信业务扩大开放累计 166 家外资获批：服务业开放里程碑

概述

我国增值电信业务对外资的扩大开放已迈上新台阶。据工业和信息化部数据，截至 2026 年上半年，增值电信业务扩大开放试点已累计向 166 家外资企业发放经营试点批复。这一进展具有标志性意义：我国电信业正从局部、渐进式的探索，迈入全业务覆盖、规则透明的制度型开放新阶段。

该试点由工业和信息化部牵头，在北京、上海、海南、深圳四地实施。这四个城市被选为扩大外资参与的试验田——在此之前，电信领域长期受到股权比例与市场准入限制。此项扩大开放建立在清晰的政策脉络之上：中国持续稳步放宽服务业外资准入，而增值电信业务相对于基础电信业务风险更可控，成为重要的先行开放切入点。

试点推进

试点于 2025 年 2 月正式起步，首批 13 家外资企业试点批复在北京、上海、海南、深圳四地发放。这一首批批复确立了行政管理模板：外资申请人向地方通信主管部门提交申请，主管部门依据试点范围审核，并将符合条件的案件报送工业和信息化部，由其发放正式试点批复。

从 2025 年初的首批 13 家，到 2026 年上半年累计达 166 家，批复数量稳步攀升。这种加速既反映出外资热情的上升，也体现出审核与批复流程的日趋成熟——随着先例不断积累，审批预期变得更加可预测。

开放规模

整体数据凸显了开放的广度。截至 2026 年上半年，全国外商投资电信企业累计达 3219 家，较去年同期增长 23.9%。尤为关键的是，这些企业的经营范围已覆盖《电信业务分类目录》全部 10 项增值电信业务。这是试点框架下外资运营商首次能够触及全部增值电信业务类别。

国务院新闻办公室 2026 年 7 月 20 日举行的新闻发布会，介绍了 2026 年上半年工业和信息化发展情况：电信业务总量同比增长 7.9%，电信业开放发展水平稳步提升。数据从官方层面确认，开放并未带来行业震荡，而是伴随了健康增长。

覆盖业务

在试点框架下，外资企业可开展一组明确界定的增值电信业务，核心许可活动包括：

  • 互联网接入服务——向终端用户和企业提供互联网连接。
  • 在线数据处理与交易处理——支撑数据交换、电子商务及交易结算的平台业务。
  • 信息服务——内容与信息递送服务，包括应用商店、信息发布及相关增值业务。

上述类别均位于《电信业务分类目录》更宽泛的 10 项增值电信业务框架之内。通过试点进入的外资企业须在获批范围内运营，并遵守中国的网络安全、数据与内容监管规定——这些规定对内外资经营者一视同仁。

外资企业如何申请

有意参与试点的外资投资者通常遵循结构化路径：

  1. 选定试点城市。 在北京、上海、海南、深圳四地之一设立或指定运营主体，作为试点运营基地。
  2. 确认可开展业务范围。 将拟开展业务映射到许可的增值电信业务类别（互联网接入、在线数据处理与交易处理、信息服务等试点范围内的业务）。
  3. 向地方通信主管部门申报。 向所选城市的省或市级通信管理局提交试点申请，包括企业、技术与合规材料。
  4. 工业和信息化部试点批复。 地方主管部门审核后，将符合条件者上报工信部，由其发放增值电信业务经营试点正式批复。
  5. 在范围内运营。 获批后，企业在试点区域内开展获批增值电信业务，并履行持续监管与报送义务。

实际周期因个案复杂程度与材料完备度而异，但 166 家批复的积累表明，这已是一套可运转、可复制的流程，而非一次性安排。

实务提示

对外资进入者而言，有几点值得关注。其一，试点仍受四地地理边界约束，在范围外运营需另行授权。其二，”全部 10 类覆盖”是指全国层面的总体图景——单家批复仍界定该企业具体可开展的业务类别。其三，外资运营商同样须完全遵守中国的数据安全、个人信息保护与内容监管制度。最后，外商投资电信企业 23.9% 的同比增长释放出积极信号，但成功仍取决于本地伙伴、合规准备与清晰的服务定位。

延伸阅读

  • 工业和信息化部官网发布试点 governing 通知及获批企业名单。
  • 人民邮电报对 2026 年 7 月 20 日国新办发布会的报道，详述了 2026 年上半年电信业扩大开放的”加速度”。
  • 工业和信息化部关于 2025 年 2 月北京首批批复的报道，记录了首都 4 家外资企业取得试点批复的开放进程。

Sources

  • 工业和信息化部（增值电信业务扩大开放试点主管单位）：https://www.miit.gov.cn/
  • 人民邮电报 / 国新办 2026 上半年工业和信息化发展新闻发布会，电信业扩大开放”加速度”：https://rmydb.cnii.com.cn/html/2026/20260724/20260724_001/20260724_001_05_8088.html
  • 北京 4 家外资企业取得增值电信业务扩大开放试点批复（工业和信息化部）：https://www.miit.gov.cn/xwfb/gxdt/dfdt/art/2025/art_b47d4bb2199148adbf7172beda5b8d12.html
PIPL Compliance / 个保法合规

PIPL Compliance for Foreign Companies

  • PIPL took effect on 1 November 2021 and has extraterritorial reach, binding overseas processors that handle personal information of individuals in China.
    《个人信息保护法》于2021年11月1日施行，并具有域外效力（第三条），约束处理中国境内自然人个人信息的境外处理者。
  • Processing requires a documented lawful basis under Article 13; consent is prominent but not the only one, with eight bases including contract necessity and legal obligation.
    处理须具备第十三条项下的合法性基础；同意最为常见但非唯一，八种基础含合同必需与法定义务。
  • Sensitive personal information (biometrics, health, financial accounts, minors under 14) requires separate consent and stricter safeguards.
    敏感个人信息（生物识别、医疗健康、金融账户、不满十四周岁未成年人等）须取得单独同意并采取更严格保护。
  • A PIPIA is mandatory before sensitive-data, automated-decision, third-party-sharing, or cross-border processing, with the report retained for at least three years.
    处理敏感数据、自动化决策、对外提供或跨境提供前必须事前开展个人信息保护影响评估（第五十五条），报告至少保存三年。
  • Processors reaching the CAC volume threshold must appoint a Personal Information Protection Officer, and overseas processors must set up a China entity or designate a local representative.
    达到网信办量级阈值的处理者须指定个人信息保护负责人，境外处理者须在中国境内设专门机构或指定代表（第五十三条）。
  • CIIOs and threshold processors must localize personal information and pass a CAC security assessment before export; others may use certification or a standard contract, but separate consent is always required.
    关键信息基础设施运营者及达阈值处理者须境内存储个人信息并通过网信办安全评估方可出境；其他可择认证或标准合同，但均须取得单独同意。
  • Data classification and early selection of the correct outbound pathway (security assessment vs. standard contract vs. certification) usually drive the compliance timeline.
    数据分类与尽早选定出境路径（安全评估／标准合同／认证）通常决定合规工期。

PIPL Compliance for Foreign Companies | 外资企业的个人信息保护法合规

Overview

China’s Personal Information Protection Law (PIPL) took effect on 1 November 2021 and is the country’s comprehensive, GDPR-style statute governing the processing of personal information. It applies not only to companies established inside mainland China but also, under its extraterritorial reach, to overseas processors that handle the personal information of individuals in China in the course of providing products or services to them, or in analysing and assessing their behaviour. For a foreign-invested enterprise (FIE) operating in China — a WFOE, joint venture, representative office, or a foreign group serving Chinese users — PIPL compliance is a board-level obligation, not a back-office formality.

This article explains the core building blocks of PIPL compliance that foreign companies must understand: the lawful bases for processing, the obligation to conduct a Personal Information Protection Impact Assessment (PIPIA), the appointment of a data-protection officer and a local representative, and the rules on localization and cross-border transfer of personal data.

Lawful basis for processing

Under PIPL, a personal information processor may process personal data only where at least one of several lawful bases applies. Consent is the most prominent, but it is not the only one. The recognized bases are: (1) consent of the individual; (2) necessary for concluding or performing a contract to which the individual is a party; (3) necessary for human-resources management under lawfully formulated labour rules and collective contracts; (4) necessary to perform statutory duties or obligations; (5) necessary to respond to a public-health emergency or to protect life, property, or other significant lawful rights in an emergency; (6) necessary for news reporting or public supervision in the public interest; (7) processing of already-disclosed personal information within a reasonable scope; and (8) other circumstances prescribed by laws or administrative regulations.

For most FIEs, the practical mix is consent (for marketing, cookies, and product analytics) plus contract necessity (for core service delivery) plus legal obligation (for HR, tax, and regulatory filings). A foreign company should map each processing activity to a documented basis and avoid relying on consent where a stronger basis exists, because consent can be withdrawn at any time. Sensitive personal information — biometrics, health and medical data, financial accounts, religious belief, specific identity, whereabouts, and the personal information of minors under 14 — requires *separate* consent and stricter safeguards.

Personal Information Protection Impact Assessment (PIPIA, Article 55)

Where the risk to individuals is elevated, PIPL requires a prior impact assessment, the Chinese analogue of the GDPR DPIA. A PIPIA is mandatory before: processing sensitive personal information; using personal information for automated decision-making (profiling, credit scoring, algorithmic recommendations); entrusting, providing, or publicly disclosing personal information to other parties; transferring personal information outside China; and any other processing that may have a significant impact on individuals.

The assessment must cover whether the purpose and means are lawful, legitimate, and necessary; the impact on individuals’ rights and the security risks; and whether the protective measures are valid and proportionate. The report and the processing record must be retained for at least three years. PIPIA is a living document that should be refreshed whenever the processing changes materially, and it is distinct from the periodic compliance audit that Article 54 requires all processors to conduct.

Data-protection officer and local representative (Articles 52–53)

A processor that handles personal information up to the amount prescribed by the national cyberspace authority (CAC) must designate a person in charge of personal information protection — a role often called the Personal Information Protection Officer (PIPO). The officer supervises processing activities and the protective measures taken, and the processor must publish the officer’s contact information and file the name and contact details with the personal-information protection authority.

Critically for foreign companies, Article 53 provides that overseas processors caught by Article 3 must establish a dedicated entity within China or designate a representative in China to handle personal-information protection matters, and must submit the entity’s or representative’s name and contact details to the authorities. A foreign parent that processes Chinese users’ data from abroad therefore cannot remain invisible to Chinese regulators; it must have a local point of accountability. Large internet platforms with huge user bases face additional duties under Article 58, including an independent supervisory body composed mainly of external members.

Localization and cross-border transfer (Articles 38–40)

PIPL draws a hard line between domestic storage and outbound transfer. Critical Information Infrastructure Operators (CIIOs) and processors that handle personal information reaching the threshold set by the CAC must store within China the personal information collected and generated inside the country. Where outbound transfer is truly necessary, it must pass a CAC-organized security assessment. Other processors may rely on one of three alternative outward-transfer mechanisms: (a) the CAC security assessment; (b) personal-information protection certification by a specialized institution designated by the CAC; or (c) a standard contract concluded with the overseas recipient under the CAC template. In every cross-border case, the individual’s separate consent must be obtained, and the individual must be informed of the overseas recipient’s identity, contact details, purpose, means, and types of information, plus how to exercise their rights.

The CAC has progressively clarified these thresholds through the 2022 Measures on Security Assessment of Data Exports, the 2023 Standard Contract Measures, and the 2024 Provisions on Promoting and Regulating Cross-Border Data Flows. As a rule of thumb, routine intra-group HR or low-volume commercial data may qualify for the simplified standard-contract or exemption path, while large-scale or sensitive personal data, and all CIIO data, triggers the full security assessment. Foreign companies should classify their data, quantify volumes against the CAC thresholds, and choose the correct pathway early — the pathway, not the permission itself, usually drives the timeline.

What to do next

  • Map your processing activities to a documented lawful basis under Article 13; default to contract necessity or legal obligation where consent is fragile.
  • Run a PIPIA before any sensitive-data, automated-decision, third-party-sharing, or cross-border activity, and keep the report for at least three years.
  • Appoint a Personal Information Protection Officer if you meet the CAC volume threshold, and publish and file the contact details.
  • Establish a China entity or representative if your overseas group processes Chinese individuals’ data — this is mandatory, not optional.
  • Classify data and select the right outbound pathway (security assessment vs. standard contract vs. certification) before moving any personal information offshore, and obtain separate consent.

Sources

Related reading

  • see also: Cybersecurity & MLPS (等保) for FIEs — overlapping obligations on data security and critical systems.
  • see also: VIE structures & regulatory trends — how data-security review intersects with offshore listings.
  • see also: Foreign-related dispute resolution — litigation vs. arbitration — enforcing data-compliance breaches across borders.

外资企业的个人信息保护法合规

概述

《中华人民共和国个人信息保护法》（PIPL）于 2021 年 11 月 1 日施行，是我国个人信息处理领域的综合性、对标欧盟 GDPR 的基本法律。其不仅适用于在中国大陆境内设立的企业，依其域外适用效力（第三条），境外处理者若在向中国境内自然人提供产品、服务，或对其行为进行分析、评估的过程中处理其个人信息，同样受其约束。对于在中国运营的外商投资企业（外商独资企业、合资企业、代表机构，或以境外主体服务中国用户的跨国集团）而言，个人信息保护合规是董事会层级的责任，而非后台事务。

本文梳理外资企业必须掌握的几项 PIPL 合规基石：处理的合法性基础、个人信息保护影响评估（PIPIA）义务、个人信息保护负责人与境内代表的设置，以及个人数据的本地化存储与跨境提供规则。

处理的合法性基础（第十三条）

依据 PIPL，处理者仅在具备法定情形之一时方可处理个人信息。 consent（同意）最为常见，却并非唯一基础。法律认可的合法性基础包括：（一）取得个人同意；（二）为订立、履行个人作为一方当事人的合同所必需；（三）按照依法制定的劳动规章制度和依法签订的集体合同实施人力资源管理所必需；（四）履行法定职责或者法定义务所必需；（五）为应对突发公共卫生事件，或者紧急情况下为保护自然人的生命健康和财产安全所必需；（六）为公共利益实施新闻报道、舆论监督等行为在合理范围内处理；（七）依照本法规定在合理范围内处理已公开的个人信息；以及（八）法律、行政法规规定的其他情形。

对多数外资企业而言，实操中的基础组合是：同意（用于营销、Cookie、产品分析）+ 合同必需（用于核心服务交付）+ 法定义务（用于人事、税务与监管报送）。企业应将每一项处理活动映射到书面记载的合法性基础，并避免在存在更强基础时仍依赖同意，因为同意可随时撤回。敏感个人信息——生物识别、医疗健康、金融账户、宗教信仰、特定身份、行踪轨迹以及不满十四周岁未成年人的个人信息——须取得”单独同意”并采取更严格保护。

个人信息保护影响评估（第五十五条）

当对个人权益的风险较高时，PIPL 要求事前开展影响评估，即我国对标 GDPR DPIA 的制度（PIPIA）。出现下列情形之一，必须事前评估：（一）处理敏感个人信息；（二）利用个人信息进行自动化决策（用户画像、信用评分、算法推荐）；（三）委托处理、向他人提供、公开披露个人信息；（四）向境外提供个人信息；以及（五）其他对个人权益有重大影响的情形。

评估内容应包括：处理目的与方式是否合法、正当、必要；对个人权益的影响及安全风险；所采取的保护措施是否合法、有效并与风险程度相适应。评估报告与处理情况记录应至少保存三年。PIPIA 是动态文件，处理活动发生重大变化时须重新评估；它不同于第五十四条要求的、所有处理者均应定期开展的事后合规审计。

个人信息保护负责人与境内代表（第五十二、五十三条）

处理个人信息达到国家网信部门规定数量的处理者，应当指定个人信息保护负责人，负责对处理活动及保护措施进行监督，并公开其联系方式、将姓名与联系方式报送履行个人信息保护职责的部门。

对外资企业尤为关键的是第五十三条：在境外处理境内自然人个人信息、且受本法第三条约束的境外处理者，应当在境内设立专门机构或者指定代表，负责处理个人信息保护相关事务，并将其名称或代表的姓名、联系方式等报送监管部门。换言之，境外母公司若从中国境外处理中国用户数据，不可能对中国监管保持”隐身”，必须落实本地问责主体。用户数量巨大、业务类型复杂的重要互联网平台，还须依第五十八条履行额外义务，包括设立主要由外部成员组成的独立监督机构。

本地化与跨境提供（第三十八至四十条）

PIPL 在本土存储与出境之间划出明确界线。关键信息基础设施运营者，以及处理个人信息达到国家网信部门规定数量的处理者，应当将在境内收集和产生的个人信息存储在境内；确需向境外提供的，应当通过国家网信部门组织的安全评估。其他处理者可在三种出境机制中择一：（一）安全评估；（二）经专业机构进行的个人信息保护认证；（三）与境外接收方订立标准合同（依网信办范本）。无论采取何种路径，均须取得个人的单独同意，并告知境外接收方名称、联系方式、处理目的与方式、信息种类及个人行权途径。

网信办已通过 2022 年《数据出境安全评估办法》、2023 年《个人信息出境标准合同办法》及 2024 年《促进和规范数据跨境流动规定》逐步细化阈值。实务经验是：常规集团内人事或低量级商业数据，可能适用标准合同或豁免路径；大规模或敏感个人信息，以及所有 CIIO 数据，则触发完整安全评估。外资企业应先做数据分类、按网信办阈值核算量级，并尽早选定合规路径——通常制约工期的不是”是否允许”，而是所选路径本身。

下一步建议

  • 梳理处理活动并对照第十三条记载合法性基础；在同意较为脆弱时优先适用合同必需或法定义务。
  • 开展 PIPIA：凡涉及敏感数据、自动化决策、第三方共享或跨境提供，须事前评估并将报告保存至少三年。
  • 指定个人信息保护负责人：若达到网信办量级阈值，须设岗并公开、报送联系方式。
  • 设立境内机构或代表（第五十三条）：境外集团若处理中国境内自然人数据，此项为强制要求，不可省略。
  • 分类数据、选定出境路径（安全评估 / 标准合同 / 认证），并在任何个人信息出境前取得单独同意。

来源

相关阅读

  • 参见：网络安全与等保（外资适用）— 数据安全与关键信息系统的叠加义务。
  • 参见：VIE 架构与监管趋势 — 数据安全审查如何与境外上市相交织。
  • 参见：涉外争议解决：诉讼与仲裁 — 跨境执行数据合规违规后果。
Cybersecurity / 网络安全, PIPL Compliance / 个保法合规

Network Data Security Risk Assessment: The New Annual Obligation for Important Data Processors (Effective 20 August 2026)

  • The Measures for Network Data Security Risk Assessment, jointly issued by the CAC, MIIT and MPS, took effect on 20 August 2026.
    由国家网信办、工业和信息化部、公安部联合制定的《网络数据安全风险评估办法》于 2026 年 8 月 20 日起施行。
  • Important data processors must conduct a risk assessment at least once a year; when the security status of important data changes materially, a targeted assessment is required for the changed parts.
    重要数据处理者应当每年至少开展一次风险评估；重要数据安全状态发生重大变化时，还须针对变动部分及时开展专项评估。
  • Network data processors may conduct assessments themselves or entrust third-party institutions; in high-risk situations authorities may require assessment by a certified evaluation institution.
    网络数据处理者可自行开展风险评估，也可委托第三方机构；存在较大安全风险等情形时，有关部门可要求其委托通过认证的评估机构开展评估。
  • Important data processors must submit the risk assessment report to the relevant authority within 20 working days after completing the annual assessment.
    重要数据处理者应当在年度风险评估完成后的 20 个工作日内，按照有关主管部门要求报送风险评估报告。
  • The measures create a cross-department special working mechanism and prohibit repeated assessment of the same risk, easing the burden of multiple supervisors on the same data.
    办法建立跨部门专项工作机制，并规定对同一风险不得重复评估，化解多头监管、重复检查问题。
  • For foreign-invested enterprises that handle important data, the measures add a recurring compliance obligation that intersects with data classification, cybersecurity multilevel protection and cross-border data rules.
    对处理重要数据的外资企业而言，办法增加了一项周期性合规义务，并与数据分类分级、网络安全等级保护及跨境数据规则相互交织。

Network Data Security Risk Assessment: The New Annual Obligation for Important Data Processors (Effective 20 August 2026) | 网络数据安全风险评估：重要数据处理者新增的年度义务（2026 年 8 月 20 日施行）

Why this matters now

On 20 August 2026, the Measures for Network Data Security Risk Assessment (《网络数据安全风险评估办法》) came into force. They were jointly formulated by the Cyberspace Administration of China (CAC), the Ministry of Industry and Information Technology (MIIT) and the Ministry of Public Security (MPS), and issued as Decree No. 24. The Measures institutionalise a recurring “health check” on network data and data-processing activities: important data processors must now conduct a risk assessment at least annually, report the outcome, and adjust when the security posture of important data changes. For foreign-invested enterprises (FIEs) that operate critical systems, hold important data, or sit within supply chains that handle it, the Measures add a standing, time-sensitive compliance obligation on top of data classification, multilevel protection (MLPS) and cross-border transfer rules.

What the Measures require

The Measures define network data security risk assessment as the identification, analysis and evaluation of security risks in network data and network data-processing activities. The core duties are as follows. First, important data processors must conduct an assessment at least once a year; if the security status of important data changes materially in a way that could adversely affect data security, they must promptly assess the changed part. Second, ordinary processors are encouraged to assess at least once every three years. Third, assessment may be performed in-house or by an entrusted third-party institution; where there is a larger security risk that could harm national security or the public interest, or where a data security incident has occurred, the authorities may require the processor to entrust a certified evaluation institution. Fourth, important data processors must submit the assessment report to the competent authority within 20 working days of completing the annual assessment; where no competent authority is identified, the report goes to the provincial or national cyberspace administration.

The Measures also build an institutional layer. Under the national data-security coordination mechanism, the CAC, together with the telecom and public-security authorities, will establish a special working mechanism to guide and supervise risk-assessment work. Assessment institutions are encouraged to obtain certification; the CAC Data and Technology Support Centre, the Third Research Institute of the MPS and Taier Certification have registered the Data Security Risk Assessment Service Certification Rules with the Certification and Accreditation Administration. A key procedural protection for business: the same risk must not be assessed repeatedly, which addresses the long-standing problem of overlapping checks by different regulators.

How it affects foreign-invested enterprises

For FIEs, the practical question is whether the company is an “important data processor” — a status driven by the Data Security Law’s framework of classified and graded data protection, industry rules on important-data catalogues and MLPS filing levels. A foreign-invested manufacturer with industrial control data, a data centre operator, a platform handling large volumes of personal information, or a company designated by a regulator as holding important data will likely fall within scope. For such companies, the annual assessment is a recurring milestone that should be embedded in the compliance calendar alongside MLPS level tests, data-export security assessments and PIPL audits. The assessment covers the entire lifecycle of the data — collection, storage, use, processing, transmission, provision, disclosure and deletion — so it overlaps with personal-information protection measures for platform operators. The report-submission duty (20 working days) and the possibility of being ordered to use a certified third party create real deadlines that HR, legal, IT and security functions need to coordinate.

Practical steps

  1. Determine whether you are an important data processor. Map data assets against the important-data catalogues of your sector and confirm classification and grading; treat MLPS filing level and regulator designation as strong signals.
  2. Establish an annual assessment cycle. Fix a yearly risk-assessment date, decide whether to use an in-house team or a certified third party, and align it with other compliance milestones.
  3. Trigger targeted assessments. Monitor for material changes — new data categories, new systems, security incidents, significant cross-border flows — and assess the changed parts promptly.
  4. Manage the report obligation. Prepare the assessment report and submit within 20 working days to the competent authority, or to the provincial/national CAC where the authority is unclear; keep records of the self-assessment basis.
  5. Coordinate with cross-border and MLPS work. Use the same data inventory for risk assessment, security assessment of outbound transfers, standard-contract filings and MLPS grading to avoid duplicative but divergent analysis.
  6. Prepare for certification demands. If your sector is under scrutiny, consider obtaining a certified evaluation institution early so you can respond quickly if the authorities require an independent assessment.

Compliance notes

The Measures do not create a new licensing regime; they formalise an obligation that already exists in substance under the Data Security Law and the Regulations on the Administration of Network Data Security. Failure to conduct the required assessment, or producing false reports, can attract enforcement under those laws, including orders to stop processing important data. Foreign parent groups should also note that risk assessment results feed into the same supervisory picture as cross-border transfers, so deficiencies identified here can surface in export-security assessments. Finally, the “no repeated assessment” rule protects companies from redundant checks but assumes the company can evidence its own assessment; documentation quality is therefore a compliance asset.

网络数据安全风险评估：重要数据处理者新增的年度义务（2026 年 8 月 20 日施行）/ Network Data Security Risk Assessment: The New Annual Obligation for Important Data Processors (Effective 20 August 2026)

为什么当下重要

2026 年 8 月 20 日，《网络数据安全风险评估办法》正式施行。该办法由国家互联网信息办公室、工业和信息化部、公安部联合制定，以三部门令第 24 号发布。办法将网络数据及数据处理活动的”定期体检”制度化：重要数据处理者必须每年至少开展一次风险评估、报送结果，并在重要数据安全态势变化时动态调整。对运营关键系统、持有重要数据、或身处处理重要数据的供应链中的外资企业而言，办法在数据分类分级、等级保护与跨境传输规则之上，新增了一项常设、有时限的合规义务。

办法要求什么

办法将网络数据安全风险评估界定为对网络数据和网络数据处理活动的安全风险进行识别、分析和评价。核心义务如下。其一，重要数据处理者应当每年至少开展一次评估；重要数据安全状态发生重大变化、可能对数据安全造成不利影响时，还须针对变化部分及时开展专项评估。其二，鼓励一般数据处理者至少每 3 年开展一次评估。其三，评估既可自行开展，也可委托第三方机构；当存在可能危害国家安全、公共利益等较大安全风险，或发生数据安全事件时，有关部门可要求数据处理者委托通过认证的评估机构开展评估。其四，重要数据处理者应当在年度评估完成后的 20 个工作日内，按有关主管部门要求报送评估报告；主管部门不明确的，向省级或国家网信部门报送。

办法还构建了制度层。在国家数据安全工作协调机制指导下，国家网信部门会同电信、公安等部门建立网络数据安全风险评估专项工作机制，指导监督评估工作。评估机构鼓励通过认证；国家网信办数据与技术保障中心、公安部第三研究所、泰尔认证中心等已向国家认证认可监督管理委员会备案《数据安全风险评估服务认证规则》。对企业的一项关键程序保护：对同一风险不得重复评估，破解了此前多头监管、重复检查的突出问题。

对外资企业的影响

对外资企业，首要问题是判定是否属于”重要数据处理者”——该身份由《数据安全法》的分类分级框架、行业重要数据目录规则与等级保护备案级别共同决定。拥有工业控制数据的外资制造企业、数据中心运营方、处理大量个人信息的平台，或被监管认定持有重要数据的企业，很可能落入范围。此类公司的年度评估是一项周期性里程碑，应嵌入合规日历，与等级保护测评、数据出境安全评估和 PIPL 审计并列。评估覆盖数据全生命周期——收集、存储、使用、加工、传输、提供、公开、删除——因此与平台运营者的个人信息保护措施相互重叠。报告报送义务（20 个工作日）以及被要求委托认证第三方评估的可能，形成了 HR、法务、IT 与安全部门需要协同的真实时限。

操作步骤

  1. 判定是否属于重要数据处理者。 对照本行业重要数据目录梳理数据资产并确认分类分级；将等级保护备案级别与监管认定视为强信号。
  2. 建立年度评估周期。 固定每年评估日期，决定使用内部团队还是认证第三方，并与其他合规节点对齐。
  3. 触发专项评估。 监测重大变化——新增数据类别、新系统、安全事件、重大跨境流动——并及时评估变化部分。
  4. 管理报告义务。 编制评估报告并在 20 个工作日内报送主管部门，或报送省级/国家网信部门；留存自评估依据的记录。
  5. 与跨境与等保工作协同。 使用同一数据台账开展风险评估、出境安全评估、标准合同备案与等保定级，避免重复但口径不一的分析。
  6. 为认证要求做好准备。 若所在行业受重点监管，可提前确定认证评估机构，以便监管要求独立评估时快速响应。

合规提示

办法不创设新的许可制度，而是将《数据安全法》与《网络数据安全管理条例》下已实质存在的义务成文化。未按规定开展评估或出具虚假报告，可能依据这些法律受到处理，包括责令停止处理重要数据。境外母公司还应注意，风险评估结果与跨境传输同处一套监管图景，此处发现的缺陷可能出现在出境安全评估中。最后，”不得重复评估”规则保护企业免于冗余检查，但前提是企业能证明自身评估；因此文档质量本身就是一项合规资产。

Sources

PIPL Compliance / 个保法合规

Personal Information Compliance and Cross-Border Data for Foreign Firms: The 2026 Simplification and the Three Outbound Paths

  • The Personal Information Protection Law gives three cross-border paths — security assessment, standard contract, and certification — all now operable after the 2026 Certification Measures took effect on 1 January 2026.
    《个人信息保护法》确立安全评估、标准合同、认证三条出境路径；随2026年《个人信息出境认证办法》1月1日施行，三者均已可操作。
  • A July 2026 rule simplifies compliance for “small” processors (under 100,000 individuals), letting one park/estate rule cover many tenants and exempting minor outbound transfers from assessment, contract or certification.
    2026年7月新规为”小型”处理者（不满10万人）简化合规，允许”一份规则管多家”，并对少量出境免予评估、合同或认证。
  • The cross-border thresholds: under 100,000 individuals (or under 10,000 sensitive) may use contract or certification; over 100,000 (or over 10,000 sensitive) requires a security assessment.
    出境阈值：累计向境外提供不满10万人（或不满1万敏感）可走合同或认证；超100万人（或超1万敏感）须申报安全评估。
  • The Network Data Security Risk Assessment Measures (Decree No. 24) take effect on 20 August 2026, requiring annual risk assessments for important-data handlers.
    《网络数据安全风险评估办法》（第24号令）2026年8月20日施行，重要数据处理者须每年开展风险评估。
  • Even via certification, separate individual consent and a personal-information protection impact assessment remain mandatory;自贸区 negative lists may set local carve-outs.
    即便走认证，仍须取得单独同意并开展个人信息保护影响评估；自贸区负面清单可设定本地豁免。
  • Practical step: size your outbound volume, pick contract/certification vs assessment, and for SMEs use the simplified-rule and exemption pathways from the July 2026 measures.

实操建议：先核算出境体量，在合同/认证与评估间选型；中小微企业善用2026年7月新规的简化规则与豁免路径。

Personal Information Compliance and Cross-Border Data for Foreign Firms: The 2026 Simplification and the Three Outbound Paths | 个人信息保护与数据出境合规：小型处理者简化规定与出境三路径（2026）

China’s *Personal Information Protection Law (PIPL)*, together with the *Cybersecurity Law*, *Data Security Law* and the *Network Data Security Management Regulation*, forms a layered regime. For foreign-invested firms, two questions dominate: how to process personal information lawfully, and how to move it cross-border. A batch of 2026 measures makes both more operational — and, for small processors, lighter.

The three cross-border paths

PIPL provides three lawful outbound routes: (1) a security assessment organised by the cyberspace authority; (2) a standard contract filed with the authority; and (3) certification by a recognised professional institution. The *Measures for the Certification of Personal Information Outbound Transfer* (CAC + SAMR) took effect on 1 January 2026, completing the triad. A 2026 CAC policy Q&A fixes the volumes: a processor (other than a CIIO) providing abroad 100,000–1,000,000 individuals’ information (non-sensitive) or under 10,000 sensitive items in a year may use contract or certification; above those thresholds, a security assessment is required.

The July 2026 simplification for small processors

In July 2026 the CAC and the Ministry of Public Security issued the *Simplified-Measures Provisions for Small Personal-Information Processors*, effective 1 September 2026. A “small processor” handles fewer than 100,000 individuals. The provisions let a park, industrial base or commercial-property manager publish one unified processing rule covering many tenant processors, so small firms need not each draft their own. Critically, the provisions exempt minor outbound transfers from the assessment, standard-contract or certification obligations across six scenarios (contract performance, cross-border HR, emergencies, legal duties, and others), while preserving protection intensity.

The newly enforced risk-assessment duty

On 18 June 2026 the CAC, the MIIT and the Ministry of Public Security jointly issued the *Network Data Security Risk Assessment Measures* (Decree No. 24), effective 20 August 2026 — the first dedicated inter-agency rule on data-security risk assessment. Important-data handlers must conduct an annual risk assessment; general handlers are encouraged to do so at least every three years. Foreign firms in industrial, telecom, automotive, medical or other sectors should map whether they hold important data and calendar the assessment.

What stays mandatory

Regardless of route, separate individual consent and a personal-information protection impact assessment remain required. Certification is valid for three years and may be revoked; a foreign processor without a China establishment must appoint a local institution or representative to apply. Free-trade-zone negative lists (Tianjin, Beijing, Shanghai, Hainan, Zhejiang, Guangxi, Jiangsu, Chongqing) may specify local carve-outs, so a registered FIE should check the local list first.

Practical steps

  1. Count your data. Track cumulative outbound individuals/sensitive items against the thresholds.
  2. Pick the route. Under threshold → standard contract or certification; over → security assessment.
  3. SMEs: use the simplification. Adopt the park/estate unified rule and claim the minor-transfer exemption where eligible.
  4. Diarise the assessment. Important-data handlers — annual; others — at least triennial.
  5. Keep consent and PIA. No route waives separate consent or the impact assessment.

个人信息保护与数据出境合规：小型处理者简化规定与出境三路径（2026）

中国的《个人信息保护法》与《网络安全法》《数据安全法》《网络数据安全管理条例》共同构成分层监管。对外商投资企业而言，两个问题最关键：如何合法处理个人信息，以及如何跨境传输。2026年的一系列措施让两者更具可操作性，对小型处理者则更轻。

出境三条路径

《个人信息保护法》确立三条合法出境路径：（1）网信部门组织的安全评估；（2）向主管部门备案的标准合同；（3）经认可专业机构开展的认证。国家网信办与市场监管总局的《个人信息出境认证办法》于2026年1月1日施行，补齐”三件套”。2026年网信办政策问答明确体量：非关键信息基础设施运营者一年内累计向境外提供10万—100万人信息（非敏感）或不满1万敏感信息，可走合同或认证；超过阈值须申报安全评估。

2026年7月小型处理者简化

2026年7月，国家网信办与公安部发布《小型个人信息处理者个人信息保护简化措施规定》，自2026年9月1日施行。”小型处理者”指处理不满10万人个人信息的主体。规定允许园区、产业基地或商业物业管理者发布”一份规则管多家”的统一处理规则，小型企业无需各自起草。关键的是，规定在六类情形（订立合同、跨境人力资源管理、紧急情况、履行法定职责等）下，对少量出境免予评估、标准合同或认证义务，同时保留保护强度。

新强化的风险评估义务

2026年6月18日，国家网信办、工信部、公安部联合发布《网络数据安全风险评估办法》（第24号令），自2026年8月20日施行——首部专门的数据安全风险评估跨部门规章。重要数据处理者须每年开展风险评估；一般处理者鼓励至少每三年一次。工业、电信、汽车、医疗等行业的在华外资企业应梳理是否持有重要数据并排入日程。

仍属强制的事项

无论走哪条路径，取得单独同意并开展个人信息保护影响评估仍属强制。认证有效期三年，可被撤销；无中国住所的外国处理者须指定本地机构或代表协助申请。天津、北京、上海、海南、浙江、广西、江苏、重庆等自贸区负面清单可规定本地豁免，注册外资企业应优先核对本地清单。

实操步骤

  1. 清点数据。 按阈值跟踪累计出境人数/敏感条数。
  2. 选定路径。 未超阈值→标准合同或认证；超阈值→安全评估。
  3. 中小微企业用简化。 采用园区统一规则，并在符合条件时主张少量出境豁免。
  4. 记入评估日程。 重要数据处理者每年一次；其他至少三年一次。
  5. 保留同意与影响评估。 任何路径都不免除单独同意与影响评估。

Practitioner Quick Reference

  • Three outbound paths: security assessment, standard contract, certification — all operable since 1 Jan 2026.
    三条出境路径：安全评估、标准合同、认证——2026年1月1日起均可操作。
  • Thresholds: <100k individuals (or <10k sensitive) → contract/certification; above → security assessment.
    阈值：不满10万人（或不满1万敏感）→合同/认证；超出→安全评估。
  • SME simplification: “small” = under 100k individuals; one park rule may cover many tenants; minor transfers exempt.
    中小微简化：”小型”=不满10万人；园区一份规则可覆盖多租户；少量出境豁免。
  • Risk assessment from 20 Aug 2026: important-data handlers annually; others at least triennially.
    风险评估自2026年8月20日：重要数据处理者每年；其他至少三年一次。
  • Consent + PIA mandatory: no route waives separate consent or the impact assessment.
    同意与影响评估强制：任何路径都不免除单独同意与影响评估。

Common Pitfalls

  • Assuming certification replaces consent: separate individual consent is still required.
    以为认证取代同意：仍须取得单独同意。
  • Over-looking the FTZ list: local negative lists may carve out sectors differently.
    忽视自贸区清单：本地负面清单可能对行业有不同豁免。
  • Underestimating volume: crossing the threshold mid-year triggers a retrospective assessment.
    低估体量：年中累计越阈须将已出境数据纳入安全评估。

2026 Watchlist

  • Decree No. 24 in force (20 Aug 2026): important-data handlers begin annual assessments.
    第24号令施行（2026-08-20）：重要数据处理者启动年度评估。
  • FTZ negative lists: more pilot zones may publish field-level outbound carve-outs.
    自贸区负面清单：更多试点区域或发布字段级出境豁免。
  • CAC Q&A updates: watch further PIPL and data-export policy clarifications.
    CAC问答更新：关注个保法及数据出境政策的进一步澄清。

Sources

PIPL Compliance / 个保法合规

Cross-Border HR Data and PIPIA: Personal Information Compliance for Expatriate Workforces

  • Cross-border transfers of employee personal information are exempt from the security-assessment, standard-contract and certification routes where they implement cross-border HR management under a duly adopted labour rule or collective contract.
    按照依法制定的劳动规章制度和依法签订的集体合同实施跨境人力资源管理的员工个人信息出境，可免予安全评估、标准合同与认证。
  • A Personal Information Protection Impact Assessment (PIPIA) is still mandatory for any cross-border HR data transfer, and the report must be retained for at least three years.
    任何跨境人力资源数据传输仍须开展个人信息保护影响评估，报告须至少保存三年。
  • Separate consent and prior notice to the employee are required before sending their data offshore, unless a specific exemption applies.
    向境外提供员工数据前须取得单独同意并告知员工，除非适用特定豁免。
  • Non-employees — candidates, contractors, dependants — generally fall outside the HR-management exemption and need their own lawful basis, often the sub-100,000-record threshold or a formal route.
    非员工（候选人、承包商、家属）通常不在人力资源管理豁免范围内，须有自身合法基础，常为不满 10 万人门槛或正式路径。
  • Foreign groups should sign a cross-border data-processing agreement with the offshore parent, complete the PIPIA, and align HR systems hosted outside China with the exemption’s substance conditions.
    外国集团应与境外母公司签署跨境数据处理协议、完成影响评估，并使境外托管的 HR 系统符合豁免的实质条件。

Cross-Border HR Data and PIPIA: Personal Information Compliance for Expatriate Workforces | 跨境人力资源数据与影响评估：外籍员工个人信息合规

Why this matters now

Multinational groups run their human resources on global systems — a payroll platform in Singapore, a recruiting tool in the US, a shared service centre in Europe. For a China subsidiary, that convenience collides with the Personal Information Protection Law (PIPL) and the data-export rules: every time an expatriate’s or local employee’s record is read from, or uploaded to, a server outside China, a cross-border transfer of personal information has occurred. The rules are not a blanket ban, but they impose a compliance stack that many foreign HR teams underestimate. The October 2025 CAC *Policy Q&A on Data Export Security Management* clarified the most important relief — the cross-border HR-management exemption — and how the standard-contract filing and the PIPIA obligation interact with it. This article is a practical map for foreign-invested enterprises.

The legal baseline

Under PIPL (effective 1 November 2021) and the *Provisions on Promoting and Standardising Cross-Border Data Flows* (CAC Decree No. 16, effective March 2024), a personal-information handler that needs to provide personal information overseas must satisfy one of three mechanisms:

  1. a security assessment organised by the Cyberspace Administration of China (CAC);
  2. personal-information protection certification by a professional institution; or
  3. a standard contract with the overseas recipient, filed with the provincial CAC.

Additionally, PIPL Article 38 requires the handler to take necessary measures so the overseas recipient processes the data to PIPL’s standard, and Article 39 requires separate consent and prior notice to the individual (name/contact of the recipient, purpose, manner, types of data, and how the individual exercises their rights).

The HR-management exemption

The 2024 Provisions and the 2025 CAC Q&A confirm a critical exemption: a handler is exempt from the security assessment, standard contract and certification where it provides employee personal information overseas to implement cross-border human-resource management in accordance with a duly adopted labour rule-making procedure and a lawfully concluded collective contract.

Two conditions must hold:

  • The cross-border transfer must be necessary for implementing HR management — the Q&A indicates this covers the everyday personnel and routine business-management scenarios: onboarding submissions, compensation and benefits administration, performance evaluation, and internal compliance flows.
  • The basis must be a labour rule or collective contract adopted through the statutory democratic and publicity procedure (soliciting employee opinion, consulting the union/employee representatives, and publishing to all staff). The Q&A stresses that enterprises should adopt or localise their employee privacy / PI-protection policy through this procedure so the exemption actually applies.

A second, volume-based exemption also helps: a non-CIIO handler that, from 1 January of the current year, cumulatively provides fewer than 100,000 individuals’ personal information (excluding sensitive PI) overseas is exempt. Non-employees (candidates, contractors, dependants) are generally outside the HR-management exemption and may rely on this sub-100,000 threshold or a formal route instead.

The PIPIA is not waived

Crucially, the exemptions remove the *mechanism* (assessment/contract/certification) but not the surrounding duties. The 2025 Q&A reaffirms that, even where the HR-management or volume exemption applies, the handler must still:

  • perform a Personal Information Protection Impact Assessment (PIPIA) before the transfer, covering (i) lawfulness, legitimacy and necessity of purpose and manner; (ii) impact on individuals’ rights and security risks; and (iii) the protections’ adequacy;
  • retain the PIPIA report and processing records for at least three years;
  • obtain separate consent and give prior notice to the individual unless another lawful basis applies;
  • put in place a cross-border data-processing agreement with the overseas recipient (typically the offshore parent or affiliate) ensuring PIPL-standard protection.

The Q&A also clarifies standard-contract practice: where the same overseas recipient and a predictable annual volume are involved, a handler may file one contract rather than repeatedly; if cumulative exports from 1 January reach the assessment threshold, a security assessment must be filed with the provincial CAC.

Practical steps for the foreign group

  1. Adopt the HR policy through the statutory procedure. Solicit employee opinion, consult the union/representatives, and publish the employee personal-information protection policy so the HR-management exemption is genuinely available.
  2. Map the data flows. Catalogue which HR systems sit outside China, which employee/non-employee categories are involved, and whether sensitive PI (passport, bank account, health) is transferred.
  3. Complete the PIPIA. Document purpose, necessity, risk and safeguards; keep the report for ≥3 years. For sensitive fields, tighten minimisation and encryption.
  4. Sign the cross-border data-processing agreement with the offshore parent/affiliate, aligning it with the standard-contract template’s appendices.
  5. Track volumes. Monitor the cumulative-from-1-January count; if it approaches 100,000 (or includes sensitive PI crossing thresholds), pivot to the formal route (assessment, certification or standard contract filed with the provincial CAC).
  6. Keep evidence. Retain the adopted policy, the PIPIA report, consents/notices, and the agreement — customs/court analogies aside, CAC may verify at any time.

Common mistakes

  • Treating the HR-management exemption as removing the PIPIA and consent duties — it does not.
  • Relying on the exemption for non-employees (candidates, contractors, dependants) without a separate lawful basis.
  • Adopting the employee policy by email only, without the democratic and publicity procedure, so the exemption never validly attaches.
  • Letting global HR systems auto-sync China employee data offshore without any agreement or PIPIA on file.

跨境人力资源数据与影响评估：外籍员工个人信息合规

为何此刻值得关注

跨国集团在全球化系统上运行人力资源——新加坡的薪酬平台、美国的招聘工具、欧洲的客户服务中心。对中国子公司而言，这种便利与《个人信息保护法》（PIPL）及数据出境规则相冲突：每当外籍或本地员工的记录在位于中国境外的服务器被读取或上传，即发生个人信息跨境提供。规则并非一概禁止，但施加了诸多外国 HR 团队低估的合规栈。2025 年 10 月国家网信办《数据出境安全管理政策问答》澄清了最重要的缓和——跨境人力资源管理豁免——以及标准合同备案与影响评估义务如何与之互动。本文为外商投资企业提供实操地图。

法律基线

依 PIPL（2021 年 11 月 1 日施行）及《促进和规范数据跨境流动规定》（国家网信办令 第16号，2024 年 3 月施行），确需向境外提供个人信息的处理者须满足以下之一：

  1. 国家网信部门组织的安全评估；
  2. 专业机构进行的个人信息保护认证；或
  3. 与境外接收方订立的标准合同，并向省级网信部门备案。

此外，PIPL 第 38 条要求处理者采取必要措施，使境外接收方按 PIPL 标准处理数据；第 39 条要求取得单独同意并事先告知个人（接收方名称/联系方式、目的、方式、数据类型及个人行权方式）。

人力资源管理豁免

2024 年规定与 2025 年网信办问答确认一项关键豁免：处理者按照依法制定的劳动规章制度和依法签订的集体合同实施跨境人力资源管理、确需向境外提供员工个人信息的，免予安全评估、标准合同与认证。

须同时满足两条件：

  • 跨境提供须为实施人力资源管理所必需——问答指出其涵盖日常人事与常规业务管理场景：入职提交、薪酬福利管理、绩效评估与内部合规流转。
  • 基础须为经法定民主与公示程序（征求员工意见、与工会/员工代表协商、向全体员工公示）制定的劳动规章制度或集体合同。问答强调企业应经此程序制定或本地化员工隐私/个人信息保护政策，使豁免真正可用。

第二项基于数量的豁免亦有助益：非关键信息基础设施运营者自当年 1 月 1 日起累计向境外提供不满 10 万人个人信息（不含敏感个人信息）的，免予申报。非员工（候选人、承包商、家属）通常不在人力资源管理豁免范围内，可改依该不满 10 万人门槛或正式路径。

影响评估未被免除

关键的是，豁免移除的是*机制*（评估/合同/认证），而非周边义务。2025 年问答重申，即便适用人力资源管理或数量豁免，处理者仍须：

  • 在提供前开展个人信息保护影响评估（PIPIA），涵盖（一）目的与方式之合法、正当、必要；（二）对个人权益的影响及安全风险；（三）保护措施是否充分；
  • 将影响评估报告与处理记录保存至少三年；
  • 取得单独同意并事先告知个人，除非另有合法基础；
  • 与境外接收方（通常为境外母公司或关联公司）订立跨境数据处理协议，确保 PIPL 标准保护。

问答亦澄清标准合同实务：同一境外接收方且年度数量可合理预测的，可备案一份合同而非反复备案；若自 1 月 1 日累计出境达到评估门槛，须向省级网信办申报安全评估。

外国集团的实操步骤

  1. 经法定程序制定 HR 政策。征求员工意见、与工会/代表协商并公示员工个人信息保护政策，使人力资源管理豁免真正可用。
  2. 梳理数据流。编目哪些 HR 系统位于中国境外、涉及哪些员工/非员工类别，以及是否传输敏感个人信息（护照、银行账户、健康）。
  3. 完成 PIPIA。记录目的、必要性、风险与保护措施；报告保存 ≥3 年。对敏感字段强化最小化与加密。
  4. 与境外母公司/关联公司签署跨境数据处理协议，并与标准合同范本附录对齐。
  5. 追踪数量。监控自 1 月 1 日起累计计数；若接近 10 万人（或含敏感个人信息跨阈值），转向正式路径（评估、认证或向省级网信办备案的标准合同）。
  6. 留存证据。保存已制定政策、PIPIA 报告、同意/告知及协议——网信办可随时核查。

常见错误

  • 把人力资源管理豁免视为免除了 PIPIA 与同意义务——实则未免。
  • 对非员工（候选人、承包商、家属）依赖该豁免而无独立合法基础。
  • 仅以邮件制定员工政策，未经民主与公示程序，致豁免从未有效附着。
  • 让全球 HR 系统自动将中国员工数据同步出境，而无任何协议或留存的影响评估。

Sources

  • 国家互联网信息办公室《数据出境安全管理政策问答（2025 年 10 月）》：https://www.cac.gov.cn/2025-10/31/c_1763633376984070.htm
  • 中华人民共和国个人信息保护法（全文）：https://jxj.hangzhou.gov.cn/art/2021/11/2/art_1229265403_3957973.html
  • 促进和规范数据跨境流动规定（国家网信办令 第16号，2024 年 3 月施行）：https://www.cac.gov.cn/2025-10/31/c_1763633376984070.htm