China - Outbound Data Security Measures (2022)

Overview

The "Measures for the Security Assessment of Outbound Data Transfers" (数据出境安全评估办法) were promulgated by the Cyberspace Administration of China (CAC) and published in the Government Gazette on 7 July 2022. They took effect on 1 September 2022 and implement cross-border data transfer assessment requirements set out in the Personal Information Protection Law, the Data Security Law and the Cybersecurity Law. The Measures set out when data processors must perform security assessments for outbound transfers of important data and personal information, establish a process of self-assessment followed (where required) by provincial filing and national assessment, and define supervisory, remedial and sanctioning mechanisms. For the official promulgation and full text, see the Government Gazette publication and the CAC commentary and guidance pages including the CAC "expert interpretation" materials and the CAC-issued application guide.

Definitions

Key definitions in the Measures align with existing Chinese statutes and administrative interpretations. "Data processor" refers to an entity that collects and processes data during operations inside China. "Important data" is defined as data which, if tampered with, leaked or illegally obtained/used, may endanger national security, economic operation, social stability, public health or safety. "Providing data to overseas" includes transfer, storage, remote access, query, download or other forms of enabling overseas entities or individuals to obtain data. The Measures also reference thresholds for personal information transfer that trigger assessment obligations under the PIPL and other CAC rules.

Governance and Institutional Framework

The Measures place the Cyberspace Administration of China at the center of the assessment and supervision regime, with provincial-level CAC authorities handling intake and initial processing of assessment applications and the national CAC responsible for decisions on formal security assessments and corrective actions. Sectoral ministries (e.g., Ministry of Industry and Information Technology, National Health Commission) coordinate where sector-specific laws or national security concerns are implicated. The CAC has published explanatory materials and implementation guides to assist data processors; see the CAC site and the Government Gazette notice for the formal legal text and explanatory releases. Institutional roles include intake/filing by provincial CACs, technical review and on-site verification by national CAC teams, and engagement with other ministries for matters implicating specific national interests.

Key Focus Areas

The Measures concentrate on (1) defining the scope of transfers that require assessment (important data; personal information when specified thresholds are met; remote access by overseas parties), (2) a two-stage process combining risk self-assessment and, where applicable, formal security assessment by the national CAC, (3) mandatory documentation and templates for submissions (assessment applications, risk self-assessment reports, contractual and technical safeguards), (4) requirements that data processors take and document technical and organizational measures to protect data (classification, encryption, segregation, access controls, logging, incident response), (5) mandatory contractual obligations with overseas recipients (scope-limited use, no further transfer without consent, security obligations, supervision/cooperation provisions), (6) ongoing supervision, periodic reporting and record-keeping, and (7) remedial timelines and rectification requirements for non-compliant transfers. The Measures also emphasize protection of personal rights and interests and preservation of national security and public interest when assessing outbound transfers.

Implementation Framework

Operationally, data processors must: (a) classify data and identify whether the data falls into "important data" or constitutes personal information subject to threshold-based review; (b) conduct an internal risk self-assessment using the CAC-provided templates; (c) where the Measures require, submit an application through the provincial CAC to the national CAC with supporting documents and the self-assessment report; (d) respond to national CAC requests for supplementary information or on-site checks; (e) undertake remediation and implement the required safeguards before continuing transfers; and (f) establish continuous monitoring, recordkeeping and reporting mechanisms. The CAC has provided a submission guide and templates to standardize materials and accelerate review processes.

Monitoring and Evaluation

Monitoring is performed by provincial CAC offices (initial intake, advisory review) and the national CAC (formal assessment). The Measures require data processors to keep records of outbound transfers and assessments, to promptly report security incidents relating to outbound data and to cooperate with regulator inquiries and inspections. The national CAC may require periodic re-assessment or supervision where risk factors change. Performance metrics used in monitoring include completeness of documentation, effectiveness of technical controls, remedial action timeliness and incident history. The CAC's post-assessment oversight includes the authority to order cessation of outbound transfers that pose unacceptable risk.

Penalties, Liability, and Appeals

Sanctions for non-compliance are implemented pursuant to the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law. The Measures themselves state that violations will be handled under those statutory frameworks and, where criminal conduct is established, criminal liability will be pursued. Administrative remedies can include fines, orders to suspend or terminate data export activities, revocation of permits or qualifications, public disclosure of violations and other administrative enforcement actions. Affected entities retain rights under administrative law to seek administrative reconsideration or to bring administrative litigation against enforcement actions where permitted by law.

Relationship to Other Instruments

The Measures implement and operationalize cross-border transfer rules in the PIPL (notably provisions on designated processors and transfer conditions), the DSL (important data protection and export restrictions) and the Cybersecurity Law (assessments for critical information infrastructure operators). They also work alongside CAC-issued guidance documents such as the "Data Outbound Security Assessment Application Guide (First Edition)" and sector-specific rules (e.g., financial, healthcare) and follow-up measures addressing remote access, cloud services and supply-chain security. Entities must assess obligations under all applicable instruments when planning outbound transfers.

International Alignment

While China's Measures are domestically focused and emphasize national security and data sovereignty, they reflect global regulatory themes: risk assessment prior to data export, contractual and technical safeguards, and supervisory oversight. The Measures share procedural similarities with adequacy assessments, standard contractual clauses and transfer impact assessments used in other jurisdictions, but differ in centralization (strong regulator-led assessment) and in emphasizing national-security-related "important data" categories. The Measures may interact with international frameworks and cross-border contracts, and organizations engaging in multinational operations should map CAC requirements onto international compliance obligations.

Implementation Timeline

Sources and References