Essential China CAC Security Assessment Application Resources for Foreign Businesses
China’s cross-border data transfer security assessment, organised by the Cyberspace Administration of China (CAC), is one of the most significant regulatory hurdles facing foreign businesses that transfer data out of the People’s Republic of China. Under the Measures for Security Assessment of Cross-Border Data Transfer (《数据出境安全评估办法》), effective September 1, 2022, and subsequently amended in March 2024, businesses that meet certain thresholds must obtain CAC approval before transferring data overseas. This comprehensive resource guide provides foreign businesses with a curated directory of essential CAC security assessment application resources, including official procedural guidance, documentation templates, expert advisory services, filing best practices, and ongoing monitoring tools.
Understanding When a CAC Security Assessment Is Required
The threshold triggering a mandatory CAC security assessment has evolved since the regulation’s inception. As of the latest regulatory framework in effect through July 2026, a CAC security assessment is required under the following circumstances:
- Important data transfers: Any cross-border transfer of important data, as defined by sectoral important data catalogues published by Chinese regulators, requires a CAC security assessment before the transfer occurs. This requirement is absolute and applies regardless of the volume of data transferred.
- Critical information infrastructure (CII) operators: Any CII operator that transfers personal information or important data outside of China must pass a CAC security assessment. CII operators are identified by sectoral regulators under the Cybersecurity Law framework.
- Personal information volume thresholds: Non-CII operators that process the personal information of more than 1 million individuals and intend to transfer personal information abroad must apply for a security assessment. Additionally, non-CII operators that have accumulated cross-border transfers of personal information of over 100,000 individuals or sensitive personal information of over 10,000 individuals since January 1 of the previous year must also apply.
- CAC discretionary authority: The CAC reserves the right to require a security assessment for any cross-border data transfer that it deems may affect national security or public interests, even if the above thresholds are not met.
Important: The security assessment application process is not a mere formality. As of early 2026, the CAC’s reported approval rate for security assessment applications stood at approximately 62%, with rejections concentrated in the financial services, healthcare, and technology sectors. Applications from foreign-invested enterprises face additional scrutiny, with an average review timeline of 45–60 working days compared to 30–45 working days for domestic enterprises. Early and thorough preparation is essential.
1. Official CAC Application Portal and Procedural Resources
CAC Cross-Border Data Transfer Security Assessment Online Platform
Platform URL: cbe.cac.gov.cn
Description: The CAC’s official online filing and assessment platform is the single gateway for submitting security assessment applications. The platform accepts applications, tracks review status, and communicates regulator questions and responses. Foreign applicants must register for a platform account using their Chinese business licence number. The platform interface is Chinese-only, requiring Chinese-language proficiency or the engagement of a Chinese-language authorised representative for the application process.
Key features available on the platform:
- Online application submission with form validation
- Document upload portal for supplementary materials
- Case status tracking dashboard
- Regulator query and response messaging system
- Assessment result notification and certificate download
- Renewal application portal (assessments are valid for 2 years)
Measures for Security Assessment of Cross-Border Data Transfer (Current Version)
Source: www.cac.gov.cn — “数据出境安全评估办法” section
Description: This is the primary legal instrument that establishes the security assessment framework. Foreign businesses must obtain and carefully study the most recent version. The March 2024 amendments introduced important changes, including adjusted personal information thresholds, streamlined application procedures for low-risk transfers, and clarified timelines for regulator review. The regulation sets out the 11 specific criteria that the CAC evaluates in each assessment, including data volume, sensitivity, destination country data protection adequacy, and the necessity of transfer.
CAC Guidance Document — “Application Guide for Cross-Border Data Transfer Security Assessment”
Source: cbe.cac.gov.cn — guidance section
Description: The CAC publishes a detailed application guide that describes the submission process, required documents, review timelines, and common application deficiencies. The guide includes sample application forms, document templates, and a pre-submission checklist. While the guide is updated periodically, foreign companies should verify they are using the most current version, as the CAC updates the guidance without formal announcement as procedural requirements evolve.
Provincial CAC Liaison Offices — Pre-Submission Consultation Service
Contact: Each provincial CAC office maintains a dedicated data security consultation service
Description: Before submitting a formal application, foreign businesses may request a preliminary consultation with the provincial CAC office in their jurisdiction. These pre-submission consultations, introduced in the 2024 regulatory amendments, allow applicants to receive feedback on their application completeness, identify potential deficiencies, and clarify regulatory expectations before the formal review clock starts. While not legally binding, these consultations significantly improve the likelihood of a first-round approval. Foreign companies should request consultation at least 4–6 weeks before their planned submission date, as appointments are limited.
2. Required Application Documents and Preparation Resources
The CAC security assessment application requires a comprehensive documentary submission. The following table lists the mandatory and supplementary documents, along with preparation guidance and template sources.
| Document | Description | Preparation Guidance |
|---|---|---|
| Unified Application Form | Standardised CAC form covering applicant information, data transfer details, legal basis, and recipient information | Download from CAC platform (cbe.cac.gov.cn). Complete in Chinese. Must be signed by legal representative and stamped with company seal. |
| Data Transfer Impact Assessment Report (Self-Assessment) | Comprehensive assessment of the necessity, legality, and risk mitigation of the proposed cross-border data transfer | Must address all 11 CAC evaluation criteria. Recommended length: 30–50 pages. Legal firms and consultancies offer template-based preparation services. |
| Data Processing and Transfer Activity Description | Detailed narrative of data flows, processing purposes, data categories, volumes, recipient details, and retention periods | Should include data flow diagrams. Must cover both technical and organisational security measures in place. |
| Data Subject Consent Documentation | Evidence that separate, informed consent has been obtained from all affected data subjects for cross-border transfer | Consent forms must be in Chinese. Must document the specific purpose, recipient, data categories, and retention period for each transfer. |
| Cross-Border Data Processing Agreement | Contractual agreement between domestic data sender and overseas recipient governing data handling obligations | Should reference PIPL provisions, specify data categories and purposes, define security measures, allocate liability, and provide for data subject rights enforcement. |
| Data Security Management System Documentation | Policies, procedures, and organisational structures for data security governance | Must demonstrate alignment with DSL data classification requirements, ISO 27001 or equivalent certification is beneficial but not mandatory. |
| Legal Opinion on Overseas Recipient’s Data Protection Capability | Assessment of the legal and technical data protection environment in the destination jurisdiction | Should be prepared by qualified legal counsel familiar with both Chinese data protection law and the destination country’s legal framework. |
3. Legal Advisory Services for CAC Security Assessment Applications
The CAC security assessment is a technically demanding and procedurally complex process. Engaging legal counsel with proven experience in successful filings is essential for foreign businesses. The following law firms have established track records in CAC security assessment support.
Baker McKenzie — CAC Security Assessment Practice
Key Services: Baker McKenzie has one of the most experienced CAC security assessment practices among international law firms. Their China Data Practice team has guided over 30 foreign multinational clients through the full application process, achieving an estimated 80% first-round approval rate. Services include pre-filing readiness assessments, application document preparation, regulatory liaison throughout the review process, and response preparation for regulator queries. The firm’s ability to coordinate across Chinese and international legal teams is a particular strength.
Hogan Lovells — Cross-Border Data Transfer Advisory
Key Services: Hogan Lovells’ Beijing and Shanghai offices maintain a dedicated cross-border data transfer advisory practice that focuses specifically on CAC security assessment applications. The firm provides end-to-end application management, including data flow mapping, self-assessment report drafting, response management during the regulator’s review, and representation in consultation meetings with provincial and national CAC authorities. Hogan Lovells’ practice is supported by a proprietary regulatory tracking database that monitors CAC assessment decisions and policy trends.
Clifford Chance — China Regulatory Practice
Key Services: Clifford Chance offers a combined data protection and regulatory practice that is particularly strong for complex multinational data transfer structures. The firm has developed standardised document templates for CAC applications that are pre-reviewed against CAC expectations, significantly reducing preparation time. Their practice also provides specialist support for regulated sectors including financial services, pharmaceuticals, and automotive manufacturing, where additional sectoral regulatory approvals may be required alongside the CAC assessment.
4. Self-Assessment Report Preparation Tools and Templates
The Data Transfer Impact Assessment (DTIA) Self-Assessment Report is the most critical component of the CAC application. The following resources assist foreign businesses in preparing this document to the required standard.
OneTrust — CAC Security Assessment Module
Website: www.onetrust.com
Description: OneTrust’s China-specific module includes a dedicated CAC security assessment workflow that guides users through the self-assessment process. The tool provides a structured questionnaire aligned with the 11 CAC evaluation criteria, automated evidence collection and organisation, draft self-assessment report generation in Chinese, and version control for document updates. The module is pre-configured with the latest CAC application form versions and regulatory references.
Securiti — Cross-Border Data Transfer Assessment Platform
Website: www.securiti.ai
Description: Securiti’s platform offers AI-assisted self-assessment report preparation with automated data inventory integration. The platform connects to the organisation’s data discovery engine to automatically populate data flow descriptions, data category classifications, and volume calculations — significantly reducing the manual effort required for the self-assessment section. The platform supports both Chinese and English interfaces and generates Chinese-language report drafts that can be reviewed and finalised by legal counsel.
TC260 — Self-Assessment Guideline (GB/T 39335-2020)
Source: www.tc260.org.cn
Description: The national standard GB/T 39335-2020, “Information Security Technology — Guide for Personal Information Security Impact Assessment,” provides the methodological framework for conducting DTIAs. While originally developed for personal information assessments, the methodology has been adapted and accepted by the CAC for cross-border transfer self-assessments. The standard is available in Chinese; English summaries are available from major law firm advisory publications.
5. Step-by-Step CAC Security Assessment Application Process
Step 1: Determine Applicability and Threshold Assessment
Conduct a thorough data mapping exercise to determine whether your organisation’s proposed cross-border data transfers trigger the mandatory security assessment threshold. Document the types of personal information and important data processed, data volumes, transfer purposes, and recipient details. Engage legal counsel to confirm threshold applicability based on the latest regulatory interpretation.
Estimated timeframe: 4–6 weeks
Step 2: Engage Provincial CAC for Pre-Submission Consultation
Submit a preliminary consultation request to the provincial CAC office in the jurisdiction where your Chinese entity is registered. Prepare a briefing document summarising the proposed data transfers, data volumes, recipient details, and security measures. Use the consultation to receive feedback on potential deficiencies and regulatory expectations before formal submission.
Estimated timeframe: 2–4 weeks for consultation appointment
Step 3: Prepare Application Documentation Package
Compile all required application documents listed in the table above. This is the most time-consuming phase and requires coordination across legal, compliance, IT security, and business operations teams. The self-assessment report will constitute the majority of the preparation effort. All documents must be submitted in Chinese. Engage professional translation services for any documents originally prepared in English.
Estimated timeframe: 8–12 weeks
Step 4: Submit Application via CAC Online Platform
Upload all documents through the CAC’s online platform (cbe.cac.gov.cn). Ensure all required fields are completed, all mandatory documents are attached, and the application form is properly signed and sealed. The platform will generate a submission receipt, which should be retained for tracking purposes.
Estimated timeframe: 1 day
Step 5: Respond to CAC Queries During Review
During the review period (typically 30–60 working days for foreign enterprises), the CAC may issue formal queries requesting additional information or clarification. Respond promptly and comprehensively. Each query response resets the review clock, so thorough initial submissions reduce the total review time. Maintain a query response log and engage legal counsel to review all responses before submission.
Estimated timeframe: 30–60 working days
Step 6: Receive Assessment Decision and Implement Conditions
The CAC will issue either an approval certificate (valid for 2 years) or a rejection decision with reasons. If approved, implement any conditions attached to the approval. The approval certificate number must be referenced in all subsequent cross-border data processing agreements. If rejected, review the reasons, address deficiencies, and prepare a revised application for resubmission. The 2024 amendments allow for simplified resubmission within 90 days of a rejection.
Estimated timeframe: Decision within 15 working days after review completion
Step 7: Ongoing Compliance and Renewal Monitoring
Maintain records of all cross-border data transfers conducted under the approved assessment. Monitor for material changes in data types, volumes, processing purposes, or recipient details that may require a new or supplementary assessment. Begin the renewal application process at least 6 months before the 2-year assessment validity period expires.
Estimated timeframe: Ongoing
6. Common Application Pitfalls and How to Avoid Them
Based on the experience of law firms and consultancies that have processed hundreds of CAC security assessment applications, the following are the most common reasons for application rejection or extended review:
- Insufficient data mapping detail: The most frequent deficiency found in rejected applications is inadequate description of data flows. Applications that fail to identify all data categories, data volumes, processing systems, and downstream recipients are routinely returned for supplementation. Foreign companies should invest in comprehensive data discovery and mapping tools before beginning the application process.
- Weak self-assessment report quality: Self-assessment reports that provide generic, template-driven analysis without specific reference to the applicant’s actual data processing environment fail to satisfy the CAC’s 11 evaluation criteria. Each criterion must be addressed with concrete evidence and analysis specific to the proposed transfer.
- Inadequate consent documentation: The CAC scrutinises consent documentation carefully. Consent forms that use generic language, fail to specify the exact data categories being transferred, or do not clearly inform data subjects of the overseas recipient’s identity are frequently cited as deficiencies. Consent must be granular and specific.
- Missing sectoral approvals: Certain sectors (finance, healthcare, telecommunications) require additional regulatory approvals beyond the CAC security assessment. Applications filed without evidence of these sectoral approvals will be rejected. Foreign companies must identify all applicable regulatory requirements at the outset.
- Incomplete Chinese-language documentation: All application documents must be submitted in Chinese. Documents prepared in English and translated at the last minute often contain translation errors or cultural nuances that confuse evaluators. Engage professional legal translators who specialise in Chinese regulatory documentation.
7. Industry Association and Support Network Resources
European Chamber of Commerce in China — Cross-Border Data Transfer Working Group
Website: www.europeanchamber.com.cn
Description: The European Chamber’s Cross-Border Data Transfer Working Group provides a forum for member companies to share CAC security assessment experiences, best practices, and regulatory intelligence. The group maintains a shared knowledge base of CAC assessment outcomes (anonymised), facilitates peer review of application documents, and coordinates advocacy positions on cross-border data transfer regulations. The group meets monthly and typically has 40–60 participating companies.
AmCham China — Digital Economy Committee
Website: www.amchamchina.org
Description: AmCham China’s Digital Economy Committee includes a cross-border data transfer task force that monitors CAC security assessment trends and advocates for regulatory clarity. The committee publishes an annual “Cross-Border Data Transfer Compliance Report” that surveys member companies’ experiences with the assessment process. The 2025 report included data from 85 applications, providing detailed insights into approval timelines, common deficiencies, and regulator expectations.
Conclusion
The CAC security assessment is one of the most consequential regulatory requirements facing foreign businesses that transfer data out of China. Successful navigation of the process requires careful preparation, comprehensive documentation, expert legal support, and realistic timeline management. The resources compiled in this guide provide a comprehensive foundation for foreign businesses preparing their CAC security assessment applications. By leveraging official procedural guidance, professional advisory services, purpose-built compliance tools, and industry peer networks, foreign companies can significantly increase their likelihood of a first-round approval and maintain compliant cross-border data transfer operations in China.
Last updated: July 2026. Regulatory references may change. Always verify with official sources before acting on this information.
