Issued by:    Cyberspace Administration of China, State Administration for Market Regulation
Issue No.:    Order No. 20 of the Cyberspace Administration of China, the State Administration for Market Regulation
Release Date:    October 14, 2025
Effective Date:    January 1, 2026
Links:    https://www.cac.gov.cn/2025-10/17/c_1762449728720008.htm

The Measures signifies the full establishment of the institutional framework for the three legal pathways (namely, Security Assessment, Standard Contracts, and Personal Information Protection Certification) for personal information export as stipulated in the Personal Information Protection Law. The main contents are as follows:

1. Certification and Standard Contracts: Provided that the export is not exempted and does not trigger a mandatory Security Assessment, personal information processors may choose either a Standard Contract or Personal Information Protection Certification for the export of personal information.

2. Applicable scenarios: For exporting personal information through certification, the following conditions must be simultaneously met: 1) the entity must not be a critical information infrastructure operator. 2) starting from January 1 of the current year, the cumulative volume of personal information (excluding sensitive personal information) exported overseas exceeds 100,000 but within 1 million individuals, or the cumulative volume of sensitive personal information exported overseas is fewer than 10,000 individuals. Additionally, the personal information exported must not include important data.

 
3. Prior obligations: Before exporting personal information, personal information processors must fulfill obligations such as notification, obtaining separate consent from individuals, and conducting personal information protection impact assessments.

4. Validity period: The Certificate is valid for three years. If continued use is required upon expiry, the personal information processor must submit a certification renewal at least six months prior to the expiration date.

5. Information reporting: Professional certification bodies must report information related to the Certificate to the National Public Service Platform for Certification and Accreditation Information. This includes the certificate number, the name of the certified personal information processor, the scope of certification, and changes in certificate status, among other details.