Data Export Assessment (数据出境)

Sending data from mainland China to anywhere else, including a parent company's systems abroad, is regulated by the Personal Information Protection Law, the Data Security Law and the Cybersecurity Law, with routes and thresholds set by the Cyberspace Administration of China (CAC). Since the 2024 provisions on promoting and regulating cross-border data flows, many transfers are exempt, while others need a standard contract filing, certification, or a security assessment. This skill maps the data, finds the route, and lists what to prepare.

Write in Simplified Chinese unless asked otherwise. Thresholds and exemptions are set by CAC rules and may change, and free trade zones can publish their own negative lists; confirm with current CAC guidance and counsel. This is preparation, not legal advice.

Required Inputs

Ask for these if not provided:

• What data leaves China: categories, whether it includes personal information, sensitive personal information (敏感个人信息) or important data (重要数据), and volumes since 1 January this year
• Why: the business purpose (contract with the individual, cross-border HR management, group IT, analytics, AI training)
• Who receives it, where, and how (system access, transfer, cloud)
• Whether the company is a critical information infrastructure operator (CIIO)
• Location, including any free trade zone

Output Structure

1. Data map

| Data | Category (personal, sensitive, important, other) | Volume this year | Recipient and country | Purpose | Channel |