Personal data across borders — China
Every requirement in the theme as a row, with the provision, the deadline and the supervisor in this jurisdiction.
The question this page answers
We move personal data between the EU, the United States and China, which legal basis, which assessment and which notification applies in each jurisdiction?
Requirement rows
- Legal basis for the transfer
Personal Information Protection Law
art. 38 och 39
An outbound transfer requires one of three routes: a CAC security assessment, certification or the Chinese standard contract, plus separate consent from the individual.
- Deadline:
- Before the transfer begins
- Penalty:
- Up to CNY 50 million or five percent of the previous year's turnover
- Supervision:
- Cyberspace Administration of China
Read 2026-08-22
- Assessment before processing begins
Personal Information Protection Law
art. 55 och 56
An impact assessment is required for outbound transfers, sensitive data and automated decision-making, and the record is kept for three years.
- Deadline:
- Before the transfer begins
- Penalty:
- Order to rectify, warning, suspension of the service and a fine
- Supervision:
- Cyberspace Administration of China
Read 2026-08-22
- Notice and consent
Personal Information Protection Law
art. 14, 17 och 39
Consent is the rule, and separate consent is required for outbound transfers, sensitive data and sharing with third parties.
- Deadline:
- Ongoing, for as long as the processing continues
- Penalty:
- Up to CNY 50 million or five percent of the previous year's turnover
- Supervision:
- Cyberspace Administration of China
Read 2026-08-22
- Individual rights
Personal Information Protection Law
art. 44 till 50
Rights to know, to decide, to restrict, to obtain a copy, to correct, to delete and to be given an explanation of the processing rules.
- Deadline:
- Without delay, no fixed deadline in the statute
- Penalty:
- Up to CNY 50 million or five percent of the previous year's turnover
- Supervision:
- Cyberspace Administration of China
Read 2026-08-22
- Personal data breach
Personal Information Protection Law
art. 57
Immediate measures are taken and the authority and individuals are notified. Notice to individuals may be withheld where measures prevent harm.
- Deadline:
- Immediately, with further deadlines in the network data regulations
- Penalty:
- Order to rectify, warning, suspension of the service and a fine
- Supervision:
- Cyberspace Administration of China
Read 2026-08-22
- Supervision and penalty
Personal Information Protection Law
art. 66
The authority may order rectification, withdraw permits and impose fines, and responsible individuals may be held personally liable.
- Deadline:
- No deadline stated
- Penalty:
- Up to CNY 50 million or five percent of the previous year's turnover
- Supervision:
- Cyberspace Administration of China
Read 2026-08-22
Connections
Sources and review
Register version crossover-v1.0.0 · Read 2026-08-22
This page restates written law with the provision and the official source. It is not legal advice in an individual matter.
Next step
Three ways to put the register to work in your own practice.
Start with your task
Litigation
Find support in a judgment
Search guiding decisions, see what became final and follow changes in the law.
In-house, deals
Map the rules in a transaction
Move from theme to act and on to the article that carries the duty.
Compliance
Assess the risk in a process
Risk scoring per legal area, with the sources behind every score.