- The security assessment is the highest-threshold of China’s three data-export routes and is mandatory when a Critical Information Infrastructure Operator (CIIO) exports personal information, or when any processor exports important data or large volumes of personal information.
安全评估是中国数据出境三条通道中门槛最高的一条，当关键信息基础设施运营者（CIIO）出境个人信息，或任何处理者出境重要数据、或大规模出境个人信息时，必须申报安全评估。- The statutory triggers are: CIIO exporting PI; any exporter of important data; exporters of over 1 million individuals’ personal information; and those who since 1 January of the current year have cumulatively exported over 100,000 individuals’ PI or over 10,000 individuals’ sensitive PI.
法定触发情形为：关键信息基础设施运营者出境个人信息；任何重要数据出境方；累计出境个人信息超过 100 万人的处理者；以及自当年 1 月 1 日起累计出境个人信息超过 10 万人或敏感个人信息超过 1 万人的处理者。- The 2024 Provisions exempt a long tail of low-risk flows — notably general cross-border HR management, contract-performance necessity, and sub-100k non-sensitive PI — so many FIEs fall outside the assessment entirely.
2024 年《促进和规范数据跨境流动规定》豁免了大量低风险出境情形——尤其是常规跨境人力资源管理、履行合同必需，以及 10 万人以下的非敏感个人信息出境，因此许多外资企业实际上不落入安全评估范围。- The assessment runs through a provincial网信 office to the national CAC, with a 7-working-day acceptance decision, a 45-working-day review (extendable), a 2-year validity, and a built-in renewal path introduced by the 2024 rules.
评估由省级网信部门报送国家网信部门，7 个工作日内决定是否受理，45 个工作日内完成评估（可延长），结果有效期 2 年，2024 年规定新增了有效期延长申请机制。- FIEs should map their data, identify whether they are a CIIO or a large-volume exporter, and use the third-edition filing guide (2025) and the online system at sjcj.cac.gov.cn to prepare materials before submitting.
外资企业应先梳理数据资产、判断是否构成 CIIO 或大规模出境方，并依据 2025 年第三版申报指南与”数据出境申报系统”（sjcj.cac.gov.cn）提前备齐材料再申报。- The 2026 stabilising-foreign-investment action plan explicitly supports FTZs and service-opening pilot cities in exploring scenario-based, field-level data-export negative lists, which can further narrow what needs assessment.
2026 年《利用外资固稳促优行动方案》明确支持自贸试验区和服务业扩大开放试点城市探索场景化、字段级数据出境负面清单，可进一步收窄需评估的范围。
China’s Data Export Security Assessment Route (2026): a Field Guide for Foreign-Invested Enterprises | 中国数据出境安全评估通道（2026）：外资企业实操指南
Which route, and why this one
China regulates outbound transfer of data through three parallel mechanisms established under the PIPL, the Data Security Law and the Cybersecurity Law: security assessment (administrative review), the standard contract (filed), and certification (third-party). This article focuses on the first and highest-threshold mechanism — the security assessment administered by the Cyberspace Administration of China (CAC) — because it is the one foreign-invested enterprises (FIEs) most often ask about and most often mis-classify. If your group exports only limited employee or customer data, the standard contract (covered separately) or certification may apply instead; but if you are a CIIO, export important data, or move large volumes of personal information, security assessment is mandatory.
The legal stack
The assessment rests on a layered rule set:
- The Data Export Security Assessment Measures (CAC Decree No. 11, effective 1 September 2022) set the thresholds, procedures and the two-year validity.
- The Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Decree No. 16, effective 22 March 2024) relaxed thresholds, created broad exemptions, and introduced the FTZ negative-list system and a renewal path for assessment results.
- The third-edition Filing Guide for Data Export Security Assessment (released 27 June 2025) simplified and optimised the materials required, and clarified how to apply to extend a valid result.
Together these three instruments define who must file, what to submit, and how long a cleared pathway stays valid.
Who must apply — the triggers
A processor must apply for a security assessment when any of the following applies:
- A Critical Information Infrastructure Operator (CIIO) exports personal information.
- The processor exports important data.
- The processor exports personal information of more than 1,000,000 individuals.
- Since 1 January of the current year, the processor has cumulatively exported personal information of more than 100,000 individuals, or sensitive personal information of more than 10,000 individuals.
Items 3 and 4 are the ones that catch multinational groups: a sizeable e-commerce, automotive, healthcare or education business can cross the 100,000-person line in a single year through CRM, loyalty, telematics or learning records.
What the 2024 Provisions took out of scope
Just as important as the triggers is what the 2024 Provisions exempt. The following outbound flows do not require assessment, standard contract or certification:
- Data generated in international trade, cross-border transport, academic cooperation, multinational manufacturing or marketing that contains no personal information or important data.
- Personal information collected overseas, processed in China, and returned overseas without introducing domestic PI or important data.
- Data needed to conclude or perform a contract to which the individual is a party (cross-border shopping, shipping, remittance, payment, account opening, ticketing, visa, exam services).
- Cross-border human-resources management carried out under lawfully formulated labour rules and collective contracts.
- Emergency protection of life, health or property.
- Non-CIIO processors exporting fewer than 100,000 individuals’ non-sensitive PI in a year.
For many FIEs, a careful mapping shows the bulk of routine flows fall into these exemptions, leaving only the high-volume or important-data streams for assessment.
The FTZ negative-list carve-out
Under the 2024 Provisions, a Free Trade Zone may, within the national data classification and grading framework, draw up its own negative list of data that still requires assessment, standard contract or certification. Once the list is approved by the provincial cyberspace affairs commission and filed with the national CAC and data authority, data outside that list may be exported from within the FTZ without any of the three mechanisms. The 2026 stabilising-foreign-investment action plan encourages FTZs and service-opening pilot cities to expand scenario-based, field-level negative lists, so the practical carve-out is widening.
The procedure, step by step
- Self-assessment. Before filing, the processor must perform and document a data-export risk self-assessment covering purpose, scope and necessity; the scale, type and sensitivity of the data; the overseas recipient’s safeguards; post-transfer risks; and the contractual protections agreed with the recipient.
- File with the provincial office. Submit the application, the self-assessment report, the legal document with the overseas recipient, and supporting materials to the provincial cyberspace administration, which checks completeness within 5 working days and forwards a complete package to the national CAC.
- Acceptance. CAC decides whether to accept within 7 working days of receiving a complete package.
- Review. CAC organises the assessment within 45 working days (extendable for complexity or supplementary materials). It weighs national-security and public-interest risk, the recipient country’s legal environment, the volume and sensitivity of data, and the adequacy of safeguards.
- Result and validity. The written result is valid for 2 years from issuance. The 2024 Provisions added an explicit path to apply to extend validity before expiry when business continues. Major changes to purpose, scope, type, recipient or legal environment require re-assessment.
Practical steps for an FIE
- Inventory and classify. Build a data map: what you hold, where it came from, who receives it overseas, and whether any of it is “important data” (note: absent a published important-data catalogue for your sector, you are generally not presumed to hold it).
- Test against thresholds. Tally personal-information subjects per calendar year and flag any CIIO status (often determined by your industry regulator).
- Prefer exemptions. Route routine HR, contract-performance and sub-threshold flows through the exemptions so they never enter the assessment pipeline.
- Prepare the legal instrument. The contract or binding document with the recipient must spell out purpose, scope, storage period, re-transfer limits, security measures and breach remedies.
- Use the online system. File and track through the national data-export system at sjcj.cac.gov.cn, and follow the third-edition guide’s material checklist.
- Plan for renewal. Set a calendar reminder well before the two-year expiry if the export continues.
Boundaries to keep in mind
Security assessment is not a fast-track; build 2–3 months of lead time. The result is tied to the specific data scope and recipient described — a new use case or a material change in the recipient’s control triggers re-assessment. And the three routes are alternatives, not cumulative: pick the one your facts require rather than layering them.
See also our articles on the standard contract route, the personal-information export certification route, and field-level data-export negative lists.
中国数据出境安全评估通道（2026）：外资企业实操指南
选哪条通道，为什么是这一条
中国依据《个人信息保护法》《数据安全法》《网络安全法》，建立了三条并行的数据出境机制：安全评估（行政审批）、标准合同（备案）与个人信息保护认证（第三方认证）。本文聚焦门槛最高、也是外资企业最常咨询却又最易误判的第一条——由国家网信办（CAC）实施的数据出境安全评估。若贵集团仅出境少量员工或客户数据，标准合同（另有专文）或认证可能更适用；但若属于关键信息基础设施运营者（CIIO）、出境重要数据或大规模出境个人信息，则安全评估为强制性要求。
规则体系
安全评估建立在分层规则之上：
- 《数据出境安全评估办法》（国家网信办令第 11 号，2022 年 9 月 1 日施行）划定了触发阈值、申报程序与 2 年有效期。
- 《促进和规范数据跨境流动规定》（国家网信办令第 16 号，2024 年 3 月 22 日施行）下调了阈值、创设了广泛的豁免，并引入自贸试验区负面清单制度与评估结果延长机制。
- 《数据出境安全评估申报指南（第三版）》（2025 年 6 月 27 日发布）优化简化了申报材料，并明确了如何申请延长有效评估结果。
这三部规则共同界定了”谁必须申报、申报什么、 cleared 路径维持多久”。
谁必须申报——触发情形
处理者在任一下列情形出现时，必须申报安全评估：
- 关键信息基础设施运营者（CIIO）出境个人信息。
- 处理者出境重要数据。
- 处理者出境个人信息超过 100 万人。
- 自当年 1 月 1 日起，累计出境个人信息超过 10 万人，或敏感个人信息超过 1 万人。
其中第 3、4 项最易”踩线”：一家颇具规模的电商、汽车、医疗或教育企业，仅凭 CRM、会员体系、车联网或学习记录，一年内就可能突破 10 万人的门槛。
2024 年规定划出的豁免范围
与触发情形同样重要的是 2024 年规定的豁免清单。下列出境活动无需申报评估、订立标准合同或通过认证：
- 国际贸易、跨境运输、学术合作、跨国生产制造和营销中收集和产生、不含个人信息或重要数据的数据出境。
- 境外收集产生的个人信息传至境内处理后向境外提供，且处理过程未引入境内个人信息或重要数据。
- 为订立、履行个人作为一方当事人的合同所必需（跨境购物、寄递、汇款、支付、开户、票务、签证、考试等）。
- 依照依法制定的劳动规章制度和集体合同实施的跨境人力资源管理。
- 紧急情况下为保护自然人生命健康和财产安全所必需。
- 非 CIIO 处理者一年内累计出境不满 10 万人非敏感个人信息。
对许多外资企业而言，经仔细梳理后，多数常规出境流都落入这些豁免，只有高体量与重要数据流需要走评估。
自贸试验区负面清单的”切口”
依 2024 年规定，自由贸易试验区可在国家数据分类分级保护框架下，自行制定区内仍需纳入评估、标准合同或认证管理的数据清单（负面清单）。清单经省级网信委批准并报国家网信部门、数据管理部门备案后，清单之外的数据在区内出境即可免予三种机制。2026 年《利用外资固稳促优行动方案》鼓励自贸试验区与服务业扩大开放试点城市扩大场景化、字段级负面清单，因此这一实际”切口”正在拓宽。
程序分步
- 风险自评估。 申报前，处理者须开展并记录数据出境风险自评估，涵盖目的、范围与必要性；数据规模、类型与敏感程度；境外接收方保障能力；出境后风险；以及与接收方法律文件中的保护约定。
- 向省级网信部门申报。 提交申报书、自评估报告、与境外接收方的法律文件及支撑材料；省级网信部门 5 个工作日内完成完备性查验，材料齐全则报送国家网信部门。
- 受理。 国家网信部门收到齐全材料后 7 个工作日内决定是否受理。
- 评估。 国家网信部门在 45 个工作日内组织评估（情况复杂或需补正的，可延长），综合研判国家安全与公共利益风险、接收方所在国法律环境、数据规模与敏感程度及保障措施充分性。
- 结果及有效期。 书面结果自出具之日起有效期 2 年。2024 年规定新增了有效期届满前申请延长的明确路径；若目的、范围、类型、接收方或法律环境发生重大变化，须重新申报。
外资企业的实操要点
- 盘点与分类。 建立数据地图：持有何种数据、来源、境外接收方是谁、是否构成”重要数据”（注意：在所属行业未公布重要数据目录前，一般不推定持有）。
- 对照阈值。 按自然年统计个人信息主体数量，并确认是否具 CIIO 身份（通常由行业主管部门认定）。
- 优先适用豁免。 将常规人力资源、合同履行及阈值以下流通过豁免处理，使其不进入评估管道。
- 备好法律文件。 与接收方的合同或具有法律效力的文件须明确目的、范围、保存期限、再转移限制、安全措施与违约救济。
- 走线上系统。 通过国家数据出境系统 sjcj.cac.gov.cn 申报与跟踪，并按第三版指南的材料清单准备。
- 规划续期。 若出境业务持续，务必在 2 年届满前提前设置提醒，申请延长。
须把握的边界
安全评估并非快速通道，应预留 2–3 个月前置时间。结果绑定于所申报的数据范围与接收方——新的使用场景或接收方控制权重大变化将触发重新评估。三条通道是”择一适用”而非叠加：按事实选择所需通道，而非层层叠加。
相关阅读可参见本站的”标准合同出境””个人信息出境认证”与”字段级数据出境负面清单”等文章。
Sources