The Cyberspace Administration of China (CAC) issued guidelines for organisations on filing the standard contract for the export of personal information (Guidelines) on 30 May 2023. Earlier this year, the CAC issued Standard Contract Measures for the Export of Personal Information (Standard Contract Measures), which came into force on 1 June 2023 and provide clarity on the content of the contract to be used for transfers of personal information outside China, along with conditions for execution and filing.

The Standard Contract Measures

The Standard Contract Measures provide the form and set out the formalities for the standard form contract to be used. The contract covers: (i) the contractual obligations of the exporter and importer; (ii) the impact of the data protection requirements applicable to the overseas recipient; (iii) data subject rights and remedies; (iv) contract termination; (v) liability for breach of contract; and (vi) dispute resolution. Conditions for execution and filing requirements are also prescribed.

The contract may not be relied upon for a transfer where a CAC security assessment is required under the July 2022 Measures for Security Assessment of Data Exports (although it may be used to support such assessment). For further details on the CAC security assessment, see our blog here. An assessment is required if the exporter is a critical information infrastructure operator or is any other type of business which:

1. handles personal information of more than 1 million people and transfers personal information outside China; or
2. since 1 January of the previous year, has transferred outside China either: (1) personal information of more than 100,000 individuals, or (2) the sensitive personal information of more than 10,000 individuals.

The Standard Contract Measures prohibit transferors from artificially adjusting the quantity of data processed (e.g. by splitting transfers) in order to avoid falling within the thresholds which trigger the requirement for the security assessment.

The Standard Contract Measures impose other obligations on exporters who do not need a formal CAC security assessment. They must conduct their own impact assessment and file this with the local CAC within 10 working days of the date when the standard form contract takes effect.

During the term of the contract, the exporter's impact assessment must be refreshed, and any necessary adjustments made to the contract and corresponding filing procedures repeated where:

1. there are changes to the purpose, scope, type, sensitivity, method, storage location, or the purpose and method of processing personal information by the recipient;
2. the period for which the personal information is to be stored overseas is extended; or any other circumstances that may affect data subjects' rights and interests.

The Guidelines

The Guidelines supplement the Standard Contract Measures as set out below.

1. Documentation - the documentation required to be submitted to the local CAC includes certified copies of ID documents, the standard contract, impact assessment and undertakings. Note that the guidelines include standard templates of the contract, impact assessment and undertakings;
2. CAC decision - the CAC will notify the organisation within 15 working days of whether the submission has been approved or rejected. If approved, the CAC will assign a record filing number to the organisation in respect of the submission. If rejected, the CAC will inform the organisation of the reasons why and may request amendments or additional information. Any additional information or re-submission must be completed within 10 working days;
3. Refresh - the Guidelines reiterate the situations that require the exporting organisation to reassess the transfer and which may require adjustments to the contract. Any adjustments to the contract or other materials (e.g. the impact assessment) must be re-submitted to the CAC within working 15 days.

The CAC press release and the guidelines are available here. The CAC press release about the Standard Contractual Measures is available here, the Standard Contract Measures here, FAQs on the Standard Contract Measures here, and the CAC interpretation of the Standard Contract Measures here (all in Chinese only).