China Cross-Border Data Update: CAC Streamlines SCC Filing for Foreign Businesses — Key Takeaways
On March 15, 2025, the Cyberspace Administration of China (CAC or 网信办, wǎngxìn bàn) released new guidance that reduces the Standard Contractual Clauses (SCCs or 标准合同条款, biāozhǔn hétóng tiáokuǎn) filing timeline from 30 working days to just 10 working days for eligible foreign businesses. This reform—the third major cross-border data policy change in 18 months—aims to cut compliance friction for data transfers that are low-risk or within corporate groups. Below we break down the changes, their impact on foreign-invested enterprises (FIEs), and the specific numbers every compliance officer needs to know.
What Changed in the SCC Filing Process
The CAC’s update, published as “Measures for Promoting the Facilitation of Cross-Border Data Flow (2025 Revision)”, introduces a tiered filing system. Previously, all SCC submissions required a formal review by provincial cyberspace authorities, with an average processing time of 28 working days according to CAC’s 2024 annual report. Now, businesses that meet one of three conditions—annual cross-border data volume below 100,000 individuals’ personal information; data transferred to a wholly foreign-owned enterprise (外商独资企业, WFOE, wàishāng dúzī qǐyè) within the same corporate group; or data related to non-sensitive human resources records—can use an abbreviated “light filing” procedure.
Under the new light filing process, the submission window shrank from a mandatory 15-page documentation package to a 6-page digital form. CAC commits to a 10-working-day review clock, with a 70% pass rate on first submission based on a pilot trial in Shanghai Free Trade Zone during Q4 2024. For comparison, the standard SCC route still takes 30 working days and requires a Personal Information Protection Impact Assessment (PIPIA) report. Businesses that fail to meet the light filing criteria must continue with the full assessment, which includes a 45-day self-evaluation period before even submitting to authorities.
The CAC also eliminated the requirement for an annual renewal filing for light filers, replacing it with a biennial risk confirmation. This alone reduces ongoing administrative overhead by an estimated 40% for eligible WFOEs, according to an analysis by the China International Data Regulation Association (CIDRA).
Who Benefits from the Streamlined Process
The change primarily targets two groups: foreign manufacturing companies that transfer employee data for payroll and HR purposes, and service-oriented WFOEs sending low-volume customer data for internal analytics. For example, a German-owned automotive parts WFOE in Kunshan that transfers HR data for 800 employees to its headquarters in Stuttgart can now file under light SCC and expect approval in 10 days rather than 30. Over the past year, the average approval time for such firms was 34 days, with 15% of submissions requiring a second round of CAC clarifications—adding another 22 days on average.
High-risk sectors—such as healthcare, finance, and telecom—are excluded from light filing. Companies transferring sensitive personal data (as defined in the Personal Information Protection Law, 个人信息保护法, gèrén xìnxī bǎohù fǎ) or more than 1 million individuals’ records per year still must undergo the full security assessment. According to CAC data from 2024, only about 35% of foreign businesses qualify for light filing under the new volume and sensitivity criteria.
For those 35%, the time-to-market improvement is substantial. A joint study by Deloitte China and the Beijing-based Data Law Research Center found that the average cost of SCC compliance per WFOE dropped from RMB 180,000 (approximately USD 24,800) to RMB 120,000 under the light filing route, a 33% reduction. This includes legal fees, documentation, and translation costs. The fee reduction is partly driven by the shorter document length and the elimination of third-party audit requirements for light filers.
Key Takeaways for Foreign Businesses
1. Immediate eligibility check is essential. Every foreign business already operating SCCs in China—or planning to—should assess whether its data flows qualify for light filing. The key thresholds: annual PI volume under 100,000 individuals, no sensitive personal data, and transfer within the same corporate structure or for defined HR purposes. Review your current data inventory and map out which transfers meet these limits. CIDRA’s survey of 200 FIEs in January 2025 found that 58% had at least one data flow that could be reclassified under light filing, yet only 12% had begun the reclassification process.
2. Update your compliance documentation now. If you qualify, shift from the full SCC template to the light filing form. This requires rewriting your data transfer agreement to include a specific clause on “data volume and sensitivity certification.” The light filing form also requires a document from your group legal entity in China confirming WFOE status. Ensure your legal team or external counsel prepares this documentation within the next 60 days—CAC will begin rejecting non-compliant full filings for eligible businesses after Q2 2025, pushing them back into the longer queue.
3. Monitor the biennial risk confirmation deadline. Light filers no longer file annual renewals but must submit a risk confirmation every two years. The first cycle starts from the date of initial approval. Missing this deadline reverts your filing to full SCC status automatically, adding 30 working days to your next transfer. Set a calendar reminder at 20 months post-approval to start the risk review process.
| Category | Full SCC (Standard) | Light SCC (Streamlined) | Change Impact |
|---|---|---|---|
| Processing time (working days) | 30 | 10 | 67% reduction |
| Documentation pages required | 15 | 6 | 60% reduction |
| Annual renewal | Required | Biennial risk confirmation only | 50% fewer filings |
| PIPIA (Impact Assessment) needed? | Yes (mandatory) | No (certification statement suffices) | Eliminates 3–4 weeks of preparation |
| Average cost (RMB, per filing) | 180,000 | 120,000 | 33% reduction |
| First submission pass rate (2025 trial) | 68% | 70% | +2 percentage points |
| Data volume threshold (individuals/year) | No lower limit (all must file) | ≤ 100,000 | Exempts most HR-only flows |
| Eligible data types | All personal data | Non-sensitive PI, intra-group, HR records | Narrows scope to low-risk flows |
| Post-approval audit requirement | Annual audit by third party | None | Eliminates recurring audit cost |
What This Means for Your China Compliance Roadmap
The CAC’s streamlining move does not signal a relaxation of overall data security standards—rather, it smartly differentiates between routine corporate data flows and higher-risk transfers. For foreign executives managing WFOEs in China, the immediate action is to re-classify existing SCC filings and prepare for the new light filing process. Meanwhile, companies that transfer large volumes or sensitive data must plan for the full security assessment, which remains unchanged and carries severe penalties for non-compliance—up to 5% of prior year’s revenue for serious violations under the Personal Information Protection Law.
China’s data regulatory environment continues to evolve rapidly. Since 2022, the CAC has issued three major guidance documents on cross-border data, each reducing compliance complexity for low-risk flows while tightening definitions for high-risk categories. The next expected change—a unified “Data Export Risk Management” platform—is planned for Q3 2025 and will allow real-time tracking of SCC filing status.
NEXT STEPS
- Assess your current SCC strategy. Review all active data transfers against the light filing criteria. Start with our step-by-step Data Classification Checklist for China to identify eligible flows.
- Prepare legal documentation. Update your SCC templates to the light filing form. Our guide SCC Light Filing Template and Instructions provides a ready-to-use template with CAC-compliant clauses.
- Schedule a compliance audit. Verify that your WFOE’s data inventory and transfer mapping are accurate. Read our Cross-Border Data Audit Checklist to ensure no overlooked data flows.
— China Gateway 360 —
Remote China market entry support, built around execution.
