Information date: 9 November 2026 — Under Personal Information Protection Law Article 38, an exporter may rely on a CAC security assessment, a CAC standard contract filing, or certification. The March 2024 CAC measures on promoting and regulating cross-border data flows set the thresholds, counted cumulatively from 1 January of the current year: security assessment where important data is involved, or personal information of more than 1,000,000 individuals, or sensitive personal information of more than 10,000 individuals; standard contract or certification where personal information of 100,001 to 1,000,000 individuals, or sensitive personal information of fewer than 10,000; exemption where non-sensitive personal information of fewer than 100,000 individuals. The standard contract must be filed with the provincial CAC within ten working days of taking effect, runs three years, and requires a personal information protection impact assessment before signature. Map flows first, then split them into HR, customer, vendor and research, and count distinct individuals per flow since 1 January. If any flow crosses 1,000,000 individuals, involves sensitive data above 10,000, or touches important data, plan for security assessment, which takes months. If a flow sits between 100,001 and 1,000,000 non-sensitive individuals, standard contract plus impact assessment plus filing is the cheapest compliant route. If a flow genuinely falls within HR necessity under published labour rules, record that conclusion in the assessment and keep the reasoning. If you are within 20% of a threshold, localise or aggregate before the next product launch, because architecture change is cheaper than retrospective assessment.
Verified facts and scope
Under Personal Information Protection Law Article 38, an exporter may rely on a CAC security assessment, a CAC standard contract filing, or certification. The March 2024 CAC measures on promoting and regulating cross-border data flows set the thresholds, counted cumulatively from 1 January of the current year: security assessment where important data is involved, or personal information of more than 1,000,000 individuals, or sensitive personal information of more than 10,000 individuals; standard contract or certification where personal information of 100,001 to 1,000,000 individuals, or sensitive personal information of fewer than 10,000; exemption where non-sensitive personal information of fewer than 100,000 individuals. The standard contract must be filed with the provincial CAC within ten working days of taking effect, runs three years, and requires a personal information protection impact assessment before signature.
Scope has to be fixed before the numbers mean anything: Relevant to any mainland entity transferring personal information to an overseas parent, group platform, cloud region or vendor. Split the map before counting: HR and payroll, customer and CRM, vendor and support access, clinical or product research. Confirm first whether the receiving group entity onward-transfers, whether biometric attendance, health checks or financial account data are in scope, whether any flow touches the receiving party’s regulators or national security, and whether the group already filed a contract covering the same individuals. If two group companies export the same individuals’ data to the same recipient, count them once per exporter but document the boundary, because double filing invites questions and non-filing invites penalties. Anything outside that set is a separate question with its own evidence requirement, and mixing the two is the most common way a workable plan turns into an unusable one.
For a decision on “FAQ: The CAC Standard Contract for Cross-Border Data Transfer — the PIPIA, the 100,000-Individual Threshold and Whether an HR Database or a Global CRM Filing Is Triggered”, keep three layers apart: the published rule or statistic, the company’s own orders and process records, and the assumptions nobody has tested yet. The first layer defines the external conditions, the second proves what is true for this business, and the third is where the risk actually sits. Public material cannot substitute for a contract, a system log, a sample or a live test.
A practical way to test the scope is to ask which parts of “FAQ: The CAC Standard Contract for Cross-Border Data Transfer — the PIPIA, the 100,000-Individual Threshold and Whether an HR Database or a Global CRM Filing Is Triggered” would still be true if the company changed supplier, entity or product line tomorrow. Items that survive that change belong to the rule layer and can be taken from official publications; items that do not survive belong to the operating layer and have to be rebuilt from invoices, warehouse records, customs entries or platform statements. Where Relevant to any mainland entity transferring personal information to an overseas parent, group platform, cloud region or vendor. Split the map before counting: HR and payroll, customer and CRM, vendor and support access, clinical or product research. Confirm first whether the receiving group entity onward-transfers, whether biometric attendance, health checks or financial account data are in scope, whether any flow touches the receiving party’s regulators or national security, and whether the group already filed a contract covering the same individuals. If two group companies export the same individuals’ data to the same recipient, count them once per exporter but document the boundary, because double filing invites questions and non-filing invites penalties, the two layers are frequently mistaken for each other, and an action plan built on the wrong one either over-complies or misses a deadline it never saw coming.
How the effect reaches operations
The threshold counts distinct individuals, not records, transfers or fields, and it never resets inside a calendar year, so one bulk sync in November can push a mid-sized company across a line it was below in March. The contract itself is a prescribed text: parties may add clauses but may not contradict it, so a global data processing agreement cannot be signed as-is. The impact assessment is the substantive test, covering necessity, scope, recipient handling, onward transfer and effect on the individual, and must be refreshed when processing changes. Human resources data needed to run lawfully adopted labour rules and contracts sits inside a specific exemption, but the exemption covers necessity rather than convenience, and it does not reach sensitive data such as biometric attendance or medical records sent to a group insurer.
Treating a global CRM as business contact data rather than personal information; assuming the 100,000 line covers every category of data; delaying filing because a subsidiary rather than the parent signed; missing the ten-working-day window after the contract takes effect; writing the impact assessment after the filing rather than before; treating three-year validity as automatic renewal; and assuming a self-assessment exemption survives once the flow includes important data. A second common error is counting employees by payroll record when contractors, candidates, dependants on group insurance and former staff in the same database all count as individuals whose data leaves the country.
Translated into an operating sequence, The threshold counts distinct individuals, not records, transfers or fields, and it never resets inside a calendar year, so one bulk sync in November can push a mid-sized company across a line it was below in March. The contract itself is a prescribed text: parties may add clauses but may not contradict it, so a global data processing agreement cannot be signed as-is. The impact assessment is the substantive test, covering necessity, scope, recipient handling, onward transfer and effect on the individual, and must be refreshed when processing changes. Human resources data needed to run lawfully adopted labour rules and contracts sits inside a specific exemption, but the exemption covers necessity rather than convenience, and it does not reach sensitive data such as biometric attendance or medical records sent to a group insurer. That ordering matters: check applicability first, then the transmission step, and only then the size of the gap in cost or timing. When an intermediate step cannot be confirmed, the honest response is to narrow the scope of the conclusion rather than to substitute an industry average for the company’s own figures.
The cost of getting the order wrong is asymmetric. A team that checks applicability too late usually discovers it at the point where the shipment, the filing or the invoice can no longer be changed without penalty, and by then the only remaining lever is price. A team that checks early spends a few hours on questions that turn out to be irrelevant, which is cheap by comparison. On “FAQ: The CAC Standard Contract for Cross-Border Data Transfer — the PIPIA, the 100,000-Individual Threshold and Whether an HR Database or a Global CRM Filing Is Triggered” the practical rule is therefore to spend the first hour on scope and the second on the numbers, never the other way round.
Decision
Map flows first, then split them into HR, customer, vendor and research, and count distinct individuals per flow since 1 January. If any flow crosses 1,000,000 individuals, involves sensitive data above 10,000, or touches important data, plan for security assessment, which takes months. If a flow sits between 100,001 and 1,000,000 non-sensitive individuals, standard contract plus impact assessment plus filing is the cheapest compliant route. If a flow genuinely falls within HR necessity under published labour rules, record that conclusion in the assessment and keep the reasoning. If you are within 20% of a threshold, localise or aggregate before the next product launch, because architecture change is cheaper than retrospective assessment.
The conditions should be written down so the decision can be re-run by someone else: Relevant to any mainland entity transferring personal information to an overseas parent, group platform, cloud region or vendor. Split the map before counting: HR and payroll, customer and CRM, vendor and support access, clinical or product research. Confirm first whether the receiving group entity onward-transfers, whether biometric attendance, health checks or financial account data are in scope, whether any flow touches the receiving party’s regulators or national security, and whether the group already filed a contract covering the same individuals. If two group companies export the same individuals’ data to the same recipient, count them once per exporter but document the boundary, because double filing invites questions and non-filing invites penalties. When those hold, proceed as described; when one is missing, close the gap first and decide afterwards. This is a general compliance explainer, not legal advice, and it does not cover sector rules for finance, health, automotive or human genetic resources, which impose additional restrictions. Threshold interpretation, filing portals and review practice vary between provincial cyberspace administrations and are revised frequently. Nothing here should be relied on as a substitute for a formal impact assessment or for counsel’s opinion on a specific data flow.
Two workstreams usually have to move in parallel. The compliance workstream closes the document side of “FAQ: The CAC Standard Contract for Cross-Border Data Transfer — the PIPIA, the 100,000-Individual Threshold and Whether an HR Database or a Global CRM Filing Is Triggered” — registrations, confirmations, filings — while the commercial workstream protects the delivery date, the pricing already quoted and the customer commitments that were made on the earlier reading of the rules. Running them as one queue is how small documentation gaps become missed shipment dates: the commercial side waits for a certificate that could have been requested a week earlier. Map flows first, then split them into HR, customer, vendor and research, and count distinct individuals per flow since 1 January. If any flow crosses 1,000,000 individuals, involves sensitive data above 10,000, or touches important data, plan for security assessment, which takes months. If a flow sits between 100,001 and 1,000,000 non-sensitive individuals, standard contract plus impact assessment plus filing is the cheapest compliant route. If a flow genuinely falls within HR necessity under published labour rules, record that conclusion in the assessment and keep the reasoning. If you are within 20% of a threshold, localise or aggregate before the next product launch, because architecture change is cheaper than retrospective assessment. Set one owner per workstream and one shared status sheet, and treat a red item on either side as a reason to freeze only the affected order.
Implementation checklist
- Count distinct individuals per cross-border flow from 1 January and record the counting method in writing.
- Complete the impact assessment and data-flow map before signing, not before filing.
- File with the provincial CAC within ten working days and diarise renewal ninety days before the three-year expiry.
- Name one decision owner, one execution owner and one review date.
- Keep the source page, access date, entity and internal evidence.
- On any change, reopen only the affected judgement.
Evidence and review
Start with the smallest test that can change the answer: Count distinct individuals per cross-border flow from 1 January and record the counting method in writing. Pick one real entity or one representative case, write down the continue, watch and stop conditions in advance, and record the input version, the owner, the start time and the actual result. The first pass should only look at facts that move the decision; formatting preferences are not risk.
The second pass is completed by “Complete the impact assessment and data-flow map before signing, not before filing”, and someone who did not prepare the file should spot-check one piece of critical evidence. Treating a global CRM as business contact data rather than personal information; assuming the 100,000 line covers every category of data; delaying filing because a subsidiary rather than the parent signed; missing the ten-working-day window after the contract takes effect; writing the impact assessment after the filing rather than before; treating three-year validity as automatic renewal; and assuming a self-assessment exemption survives once the flow includes important data. A second common error is counting employees by payroll record when contractors, candidates, dependants on group insurance and former staff in the same database all count as individuals whose data leaves the country. A single small deviation can be corrected in place; a repeated deviation, or one that touches a statutory duty or changes the economics, is what justifies pausing the affected part.
After “File with the provincial CAC within ten working days and diarise renewal ninety days before the three-year expiry”, compare the actual result with the baseline rather than with the impression of the team. Map flows first, then split them into HR, customer, vendor and research, and count distinct individuals per flow since 1 January. If any flow crosses 1,000,000 individuals, involves sensitive data above 10,000, or touches important data, plan for security assessment, which takes months. If a flow sits between 100,001 and 1,000,000 non-sensitive individuals, standard contract plus impact assessment plus filing is the cheapest compliant route. If a flow genuinely falls within HR necessity under published labour rules, record that conclusion in the assessment and keep the reasoning. If you are within 20% of a threshold, localise or aggregate before the next product launch, because architecture change is cheaper than retrospective assessment. When the arrangement is extended to more products, customers or processes, keep the same success test and one complete record per batch. If later information changes, update only the affected fields.
One last discipline keeps the file usable next quarter: write the closing note as if a colleague who has never spoken to the supplier has to act on it. That note states what was verified, on which date, against which source, and what remains open — on “FAQ: The CAC Standard Contract for Cross-Border Data Transfer — the PIPIA, the 100,000-Individual Threshold and Whether an HR Database or a Global CRM Filing Is Triggered” it also states which of the three actions was actually finished and which was only scheduled. Teams that skip the closing note re-litigate the same question every month, and each round costs more than the documentation would have. This is a general compliance explainer, not legal advice, and it does not cover sector rules for finance, health, automotive or human genetic resources, which impose additional restrictions. Threshold interpretation, filing portals and review practice vary between provincial cyberspace administrations and are revised frequently. Nothing here should be relied on as a substitute for a formal impact assessment or for counsel’s opinion on a specific data flow.
Limits of the conclusion
This is a general compliance explainer, not legal advice, and it does not cover sector rules for finance, health, automotive or human genetic resources, which impose additional restrictions. Threshold interpretation, filing portals and review practice vary between provincial cyberspace administrations and are revised frequently. Nothing here should be relied on as a substitute for a formal impact assessment or for counsel’s opinion on a specific data flow.
The limits are structural rather than cautious wording. Public sources describe rules and market conditions; they do not observe “FAQ: The CAC Standard Contract for Cross-Border Data Transfer — the PIPIA, the 100,000-Individual Threshold and Whether an HR Database or a Global CRM Filing Is Triggered” inside a specific company. Where the analysis quotes a second-hand interpretation, the original release has to remain reachable, and a figure that cannot be traced back does not enter the decision table. Where the point depends on Relevant to any mainland entity transferring personal information to an overseas parent, group platform, cloud region or vendor. Split the map before counting: HR and payroll, customer and CRM, vendor and support access, clinical or product research. Confirm first whether the receiving group entity onward-transfers, whether biometric attendance, health checks or financial account data are in scope, whether any flow touches the receiving party’s regulators or national security, and whether the group already filed a contract covering the same individuals. If two group companies export the same individuals’ data to the same recipient, count them once per exporter but document the boundary, because double filing invites questions and non-filing invites penalties, the conclusion is only as current as the last check of those conditions.
