PIPL Data Transfer Out of China: Is Your Company Required to Pass the CAC Assessment?

Who Needs a CAC Assessment for Cross-Border Data Transfers?

If your company transfers personal information out of China, you may be required to undergo a security assessment by the Cyberspace Administration of China (CAC). This is not optional for certain data processors. The assessment is mandatory if you process personal information of more than 1 million people, or if you have transferred personal information of over 100,000 people or sensitive personal information of over 10,000 people since January 1 of the previous year.

Understanding the Thresholds

The CAC assessment applies to critical information infrastructure operators (CIIOs) and other data processors that meet specific volume thresholds. For CIIOs, any cross-border data transfer requires the assessment. For non-CIIOs, the trigger is based on the scale of data processing. Think of it like a tax bracket: once you cross the line, you're in.

Step-by-Step Compliance Checklist

• Determine if you are a CIIO under Chinese regulations.
• Calculate the volume of personal information processed and transferred.
• If thresholds are met, prepare a self-assessment report and apply to the CAC.
• Engage a qualified lawyer to review your data mapping and transfer mechanisms.

For more details, refer to the official CAC Measures for Security Assessment of Cross-Border Data Transfer.

FAQ