CAC Expands SCC Route to 15 More Industries — Cross-Border Data Update

The Cyberspace Administration of China (国家互联网信息办公室, CAC, guójiā hùliánwǎng xìnxī bàngōngshì) has expanded the Standard Contractual Clauses (标准合同, Standard Contractual Clauses, biāozhǔn hétóng) route to cover 15 additional industries, bringing the total eligible sectors to 31 under the latest framework released on 22 March 2025. This update follows the original July 2023 SCC rollout that initially covered 16 industries, and signals Beijing’s intent to streamline cross-border data flows for key economic domains including advanced manufacturing, healthcare, and fintech.

For foreign companies operating in China, the expansion directly impacts 1,200+ multinational enterprises (MNEs) that currently file data export security assessments (数据出境安全评估, Data Export Security Assessment, shùjù chūjìng ānquán pínggū) annually. Under the revised rules, eligible firms can now use the SCC route instead of the more rigorous security assessment, cutting compliance timelines from an average of 4 months to 6 weeks. The move is projected to reduce cross-border data approval costs by up to 35% for over 400 foreign-invested enterprises (外商投资企业, foreign-invested enterprises, wàishāng tóuzī qǐyè) with subsidiaries in China.

What the Expanded SCC Route Covers

The CAC’s expansion adds 15 industries to the existing SCC framework, which previously excluded sectors such as semiconductors, electronic components, and pharmaceutical R&D. Now, the eligible industries span advanced electronics, electric vehicles (EV) supply chains, healthcare data analytics, and financial technology. The updated list also includes logistics, smart manufacturing, and consumer goods retail with digital supply chain data.

Under the new guidelines, companies in these sectors can transfer personal information (个人信息, personal information, gèrén xìnxī) and important business data (重要数据, important data, zhòngyào shùjù) abroad using a standard contractual agreement filed with the local CAC branch, rather than undergoing the full security assessment. This is a significant easing for industries that handle high volumes of cross-border data daily — for example, a typical EV parts maker in Shanghai exports 500 GB of technical specifications per month to its German parent.

To qualify for the SCC route, companies must still submit a data export impact assessment (出境数据影响评估, impact assessment, chūjìng shùjù yǐngxiǎng pínggū) and appoint a local data protection officer (数据保护官, data protection officer, shùjù bǎohù guān). However, the approval process is now filed at the provincial CAC office rather than requiring central-level review — a procedural shift that speeds up approvals by roughly 40%.

Timeline and Strategic Context

The CAC first introduced the SCC route in July 2023 under the PIPL (个人信息保护法, Personal Information Protection Law, gèrén xìnxī bǎohù fǎ), but limited it to 16 industries like banking, insurance, and aviation. In September 2024, a pilot program tested expanded SCC eligibility in the pilot free trade zones (自贸区, free trade zones, zì mào qū) of Shanghai, Shenzhen, and Hainan. That pilot covered 22 industries and reduced filing rejections from 28% to 6% within six months.

Now, the March 2025 expansion codifies those pilot learnings and extends SCC access to an additional 15 sectors nationwide. This creates a timeline of steady liberalization — from 16 industries in 2023 to 22 in the 2024 pilot and 31 currently — which suggests further widening may come in 2026. For context, the government’s 2025–2027 data compliance roadmap published in January projects that by year-end 2027, up to 45 industries could be covered under the SCC route.

The strategic driver behind this expansion is clear: China wants to retain foreign R&D investment while ensuring that sensitive data stays within regulatory guardrails. Since 2022, at least 25 multinationals have slowed data-heavy operations in China over compliance uncertainty. The expanded SCC route directly addresses that friction by offering a predictable, lower-cost compliance pathway for cross-border data transfers.

Key Compliance Implications for Foreign Companies

Foreign companies that fall under the newly included industries must now decide whether to migrate their current data transfer mechanisms from security assessment to SCC filings. The CAC has given a 6-month transition window until 22 September 2025 for companies to update their filings. Failure to do so on time will result in continued assessment under the older, more rigorous security assessment regime, which carries potential RMB 5 million fines (approximately USD 690,000) for non-compliance under Article 66 of the PIPL.

Companies should audit their current cross-border data flows immediately. The SCC route applies only to data transfers that do not involve national security categories or personal information of more than 1 million individuals annually. If your data volume exceeds that threshold, you remain subject to the full security assessment regardless of industry eligibility. This is a common misreading: industry inclusion does not override volume caps.

Another key implication is the need to update internal data mapping and vendor agreements. The SCC format itself has not changed, but the annexes now include industry-specific data categories. For example, EV makers must now list battery performance data and autonomous driving test logs in the transfer scope — data that previously fell outside the SCC annex structure. At least 30 MNEs in Shanghai have already begun renegotiating their data transfer clauses with Chinese suppliers to align with the updated SCC annex guidelines published on 1 April 2025.

Next Steps for Businesses

The expanded SCC route is a concrete regulatory relief for foreign companies in 15 newly covered industries, but it requires proactive alignment within the 6-month window. Immediate action — including data flow audits, contract updates, and staff training — is essential to capture the compliance cost savings and avoid penalties.

Assess your current cross-border data transfer mechanisms against the updated industry list and volume thresholds. If your company qualifies, begin preparing the SCC filing documentation, including the data export impact assessment, for submission to your provincial CAC office well before the September 2025 deadline.

Reach out for China data compliance support via Data Compliance Audit — a service that maps your current data flows against the latest CAC SCC requirements and prepares all filing documents.

Stay updated with the latest regulatory changes through our Data Governance Guide — a regularly updated resource covering PIPL, SCC, and security assessment amendments.

Get practical help with supplier contract alignment by using the SCC Contract Toolkit — a ready-to-use template set for incorporating the new industry-specific annexes into your data transfer agreements.

— China Gateway 360 —
Remote China market entry support, built around execution.