- Home
- Suite features
- PIPL transfer check
China data exports under PIPL: which route, which threshold
PIPL cross-border data transfer runs on thresholds. For a group's entity in China sending personal information abroad, the Personal Information Protection Law (Art. 38–40) and Order No. 16 of the Cyberspace Administration of China (CAC) set volume and data type against a security assessment, a filed standard contract, certification or an exemption. The suite's wizard indicates the band; it does not choose the route.
- PIPL · Art. 3(2), 38–40, 53
- CAC Order No. 16 · Art. 4–8
- 68 rule rows · sources as of 18 July 2026
- Important-data classification · not made
- Contract text and CAC filing · not included
Which route does a PIPL cross-border data transfer need?
One of three mechanisms, unless an exemption applies: a CAC security assessment, a filed standard contract or certification (Art. 38(1) PIPL). Since 22 March 2024, CAC Order No. 16 assigns them by headcount since 1 January, by sensitive personal information and by important data — data that authorities have notified or published as such (Art. 2).
- ExemptContract necessity, cross-border HR, emergencies (Order No. 16 Art. 5 items 1–3); under 100,000 individuals, non-sensitive, for processors that are not critical information infrastructure (CII) operators (item 4); transit data (Art. 4); data outside a pilot zone's negative list (自贸试验区, FTZ; Art. 6). Never important data.
- Contract or certificateNon-CII operators without important data: 100,000 to under 1 million individuals, or under 10,000 with sensitive personal information (Art. 8). China standard contract filing: provincial cyberspace office, within 10 working days (Order No. 13 Art. 7).
- Security assessmentCII operators and important data at any volume; otherwise the CAC security assessment threshold of 1 million individuals, or 10,000 with sensitive personal information (Art. 7; Art. 40 PIPL).
PIPL compliance for foreign companies starts earlier: does Art. 3(2) PIPL reach you, and which entity exports? The wizard takes both as given.
From the first click to five result cards
Open /suite/#pipl. Then:
- Confirm the legal notice. Shown once, before your first answer, it rules out legal advice and an attorney-client relationship.
- Pass the welcome screen. It has no PIPL card. Choose “Cross-Regulation”; returning visitors land on the PIPL twin.
- Click PIPL in the left sidebar. The lock icon opens the PIPL twin: “Actor portfolio”, “PIPL obligations”, “China data transfer”.
- Open “China data transfer”. Seven questions, four with “Not sure”: CII operator; important data; non-sensitive and sensitive headcounts since 1 January; an Art. 5 scenario; pilot-zone location; constellation — external, intra-group, remote access from abroad, or transit.
- Read the cards. Once all seven are answered, one card per path A to E, with rule row, notes and legal-basis nodes. Each card's sentence is shortened here to “within the band”, “not within the band” or “review required” (on the card: “…calls for review by legal counsel”).
What the transfer wizard shows, path by path
| Capability | Legal basis | Output |
|---|---|---|
| Band per mechanism | Art. 38(1) PIPL · Order No. 16 Art. 7, 8 | Paths A–C: within the band, not within it, or review required |
| Exemption scenarios | Order No. 16 Art. 4–6 | Path D, same three statuses; path E for pilot zones |
| Procedure notes | Orders No. 11, 13, 16, 20 | Self-assessment, 10-working-day filing, three-year validity, no volume splitting |
| Wider PIPL duties | Selected articles, Art. 17–59 and 66 PIPL | 5 roles, 4 flags in “Actor portfolio”; up to 25 cards in “PIPL obligations” |
“Review required” is an answer
For intra-group transfers and remote access, paths A to D always read “review required” (note N11) — a conservative setting of the table, not a gap in the law: Order No. 16 has no intra-group exception, and CAC filing guidelines treat query or download access from abroad as an outbound transfer. “Not sure” on important data sends A and D to review, B and C too unless CII is Yes.
The Art. 53 question next door
Choose “Extraterritorial processor (Art. 3(2) / 53)” in “Actor portfolio”; “PIPL obligations” then shows a banner and a card for the PIPL Article 53 representative or dedicated entity in the PRC. The outbound-transfer flag adds Art. 38, 39 and, for processor roles, the personal information protection impact assessment, or PIPIA (Art. 55–56).
One hypothetical subsidiary, two constellations
A hypothetical US software company's subsidiary in Suzhou, outside any pilot FTZ, has this year sent support tickets of about 250,000 users, none sensitive, to an external US vendor. No CII status, no designated important data, no Art. 5 scenario.
| Path | External vendor | Parent company instead |
|---|---|---|
| A · Security assessment | Not within the band · A-17 | Review required · A-05 |
| B · Certification | Within the band · B-15 | Review required · B-05 |
| C · Standard contract | Within the band · C-15 | Review required · C-05 |
| D · Exemption | Not within the band · D-14 | Review required · D-05 |
| E · Pilot FTZ | Not within · E-03 | Not within · E-03 |
With the external vendor, the cards point to the standard contract or certification band, and card C lists procedure notes, from impact assessment to the ban on splitting volumes. For the US parent, A to D switch to review: the law has no group privilege; the table declines to band group-internal flows.
What the China data transfer wizard leaves open
- It asks whether you were notified or designated as holding important data or operating CII; it makes no classification itself.
- Headcounts are bands you pick, not counts from your records; the actor portfolio's “CAC volume threshold reached” checkbox is separate from them.
- Path E never reads “within the band”: no zone's negative list is reproduced, and matching is left to review (note N4).
- No contract text, assessment declaration or PIPIA template; the wizard result has no download and is hidden when printing, though the obligation cards reach the applicability-statement download (“Client workflow”).
- Later CAC changes appear only once the rule table is updated. Card citations use German notation: “Erlass 16 Art. 8 Alt. 1” is Order No. 16 Art. 8, first alternative.
- Answers stay in this browser's local storage; there is no account and no sharing. Details in the trust center.
Frequently asked questions
When is a CAC security assessment required, and when is a standard contract enough?
Unless Art. 3–6 of CAC Order No. 16 exempt the transfer, a security assessment is needed for CII operators, important data, and other processors exporting non-sensitive personal information of 1 million or more individuals, or sensitive personal information of 10,000 or more, since 1 January (Art. 7). Other processors at 100,000 to under 1 million, or under 10,000 sensitive, need a filed standard contract or certification (Art. 8).
Which China cross-border data transfer exemptions apply under the 2024 CAC provisions?
Order No. 16 exempts transfers truly necessary for a contract with the individual, cross-border HR management or emergencies, and non-CII operators' exports of non-sensitive personal information of under 100,000 individuals since 1 January (Art. 5). Transit data (Art. 4) and trade and similar data with neither personal information nor important data (Art. 3) are exempt too; important data never is. Art. 39 PIPL notice remains, and separate consent where consent is the basis (Art. 13).
Do foreign companies need a representative in China under PIPL Article 53?
Yes, if the PIPL reaches them under Art. 3(2): a processor outside China offering products or services to individuals in China, or analysing their behaviour, must set up a dedicated entity or designate a representative in the PRC and report its details to the authorities (Art. 53). The suite flags this for the extraterritorial role; Regingada UG does not provide it.
Does PIPL apply to a company without an office in China?
It can. Art. 3(2) PIPL reaches processing abroad of personal information of individuals in China to provide them with products or services, to analyse or assess their behaviour, or in other circumstances provided by laws and administrative regulations. In the suite, this is a role you declare, not a test the software runs.
PIPL vs GDPR: how do the transfer rules differ?
The GDPR asks for a Chapter V instrument: adequacy, safeguards such as standard contractual clauses, or a derogation (Art. 44–49 GDPR). The PIPL asks for an Art. 38 mechanism, chosen under CAC Order No. 16, plus notice and, where consent is the legal basis, separate consent (Art. 39 PIPL). An EU-China flow can owe both; see the EU-China sector profile.
Is the wizard's result legal advice on Chinese law?
No. The wizard's disclaimer calls the result a juxtaposition for orientation, not legal advice for an individual case, and states that only the Chinese statutory text is authoritative; the English PIPL wording is a non-official working translation. Regingada UG is not a law firm. A card ending “review by legal counsel” marks a question for counsel qualified in PRC law.
The band is the table's; the route is a legal call
For a PIPL cross-border data transfer, the wizard names the band your answers fall into. How the CAC treats your remote access, whether a dataset is important data, which mechanism fits: questions of PRC law, which the cards mark for review. The wizard's closing note states that the law firm Theo Funk examines such questions in cooperation with a partner law firm admitted in the PRC; an engagement needs a separate mandate.
That note opens a pre-filled German email to the firm in your mail program, listing the rule row per path — which reflects your answers. Nothing is sent until you send it.
If the company, with no establishment in the Union, offers goods or services to people there or monitors their behaviour (Art. 3(2) GDPR), Art. 27 GDPR generally requires an EU representative — a role Regingada UG (haftungsbeschränkt) can hold. The Art. 53 PIPL representative must sit in the PRC, outside that service.