Overview of the Cross-Border Data Transfer Regime

Overview of the Cross-Border Data Transfer Regime

Since the enactment of China’s Personal Information Protection Law (PIPL) in 2021 and the Data Security Law (DSL) in 2021, foreign companies operating in China have faced a complex and evolving regulatory landscape for cross-border data transfers. The Cyberspace Administration of China (CAC) has issued detailed implementing regulations that specify exactly which documents companies must prepare when applying for a cross-border data transfer security assessment, when filing standard contractual clauses (SCCs), or when seeking certification. According to a 2025 survey by the American Chamber of Commerce in China, 68% of foreign companies reported that document preparation was the most time-consuming phase of their compliance journey, with an average of 4 to 6 months required to assemble a complete application package.

This article provides a comprehensive checklist of every document required for a cross-border data transfer application under China’s current regulatory framework. The checklist covers Security Assessment route applications (Articles 35–40 of the Data Security Assessment Measures), SCC filings (Article 6 of the SCC Provisions), and certification applications. Use this checklist as a project management tool to track your application’s progress and ensure no critical document is overlooked.

Core Documents Required for a Security Assessment Application

The CAC Security Assessment is the most rigorous compliance route and requires the most extensive documentation. Under the Measures for Security Assessment of Data Cross-Border Transfer (effective September 2022), applicants must submit the following core documents. The CAC typically requires both Chinese-language originals and certified translations for any documents originally issued in English.

Each of these documents must be prepared in accordance with specific CAC guidelines. The application form alone runs to 24 pages and requires detailed descriptions of the data processing activities, legal bases, data subject rights protections, and technical security measures in place. The CAC has published a sample application form on its official website, but the final version submitted must be tailored to the applicant’s specific circumstances.

Personal Information Protection Impact Assessment (PIPIA) Report

The PIPIA report is arguably the most substantive document in the application package. Under Article 55 of the PIPL, data processors must conduct a PIPIA before any cross-border data transfer. The assessment must cover at least the following five dimensions. First, whether the purpose and means of data processing are legitimate, necessary, and proportionate to the stated business objectives. Second, the impact on individual rights and interests, including any risks of data leakage, misuse, or unauthorized access. Third, the adequacy of security measures implemented by both the data exporter and the overseas recipient, including encryption standards, access controls, and incident response protocols. Fourth, the data protection laws and practices in the recipient country or region, including whether the country has an adequate level of protection as recognized by the CAC. Fifth, the enforceability of data subject rights under the contractual arrangements, including rights of access, correction, deletion, and complaint resolution.

The PIPIA report should include specific data points wherever possible. For example, the total volume of personal information transferred annually, the number of data subjects affected, the categories of sensitive personal information involved (such as biometric data, financial account information, or health records), and the retention periods for each data category. The CAC expects the PIPIA to be a living document that is updated whenever there is a material change in the data processing activities or the legal environment.

Data Export Contract Requirements

The data export contract is a legally binding agreement that must satisfy specific content requirements under Article 8 of the CAC’s SCC Provisions. The contract must include at least the following clauses. First, the parties’ names, addresses, and contact information. Second, the purpose, scope, type, quantity, and sensitivity level of personal information transferred. Third, the retention period and deletion obligations. Fourth, the obligations to take technical and organizational security measures. Fifth, provisions for data subject rights, including the right to know, the right to consent, the right to access, the right to correction, the right to deletion, and the right to withdraw consent. Sixth, liability allocation for data breaches and the applicable dispute resolution mechanism. Seventh, the supervisory authority and governing law, which must be Chinese law.

The contract cannot disclaim or limit liability in ways that violate the PIPL. Foreign companies should ensure that their standard data processing agreements with overseas affiliates are reviewed by Chinese-qualified data protection lawyers before submission. A 2025 review of 120 submitted SCC filings found that 43% of initial submissions were returned for contract amendments, most commonly for inadequate data subject rights provisions or insufficient breach notification timelines.

Organizational Structure and Compliance Documentation

Beyond the core legal documents, the CAC requires evidence of the applicant’s internal compliance infrastructure. This includes organizational charts showing data protection responsibilities, copies of internal data protection policies and procedures, records of data protection training completed by relevant staff, documentation of the designated Data Protection Officer (DPO) appointment and qualifications, and proof of the company’s data security incident response plan and testing records. For multinational companies, the CAC also expects documentation showing the global data governance framework and how it interfaces with China-specific compliance requirements. This is particularly important for companies that use shared IT infrastructure, centralized HR platforms, or global ERP systems that process Chinese employee or customer data. The CAC has been known to request additional documentation about global data flows beyond the China-specific scope of the application, so companies should prepare their global data processing documentation in advance.

Supporting Evidence and Supplementary Materials

The following supporting materials should be prepared in advance of filing. Copies of business licenses for both the data exporter and, where applicable, the overseas recipient entity in China. Proof of legal data collection, such as privacy policies, consent forms, and notices provided to data subjects. Technical security assessment reports issued by qualified third-party cybersecurity firms. Network security等级保护 (Multi-Level Protection Scheme) compliance certificates, if applicable. Service contracts with data processing vendors and sub-processors, along with their compliance undertakings. Correspondence with data subjects regarding data processing activities, including consent records within the past 12 months. Audit reports related to data security, including any conducted by internal audit teams or external certification bodies such as ISO 27001 or SOC 2 reports. Letters of authorization and powers of attorney for the individuals signing the application documents.

Companies should also prepare a summary document that cross-references each regulatory requirement to the specific document that satisfies it. This makes it easier for CAC reviewers to verify completeness and reduces the likelihood of follow-up questions. According to data from CAC filings statistics compiled by Dacheng Law Offices, applications that included a cross-reference table received initial approval at a rate of 76% compared to 52% for those without such a table.

Common Documentation Pitfalls and How to Avoid Them

Based on analysis of returned applications and consultations with data compliance practitioners across Beijing, Shanghai, and Shenzhen, the following documentation issues are the most common causes of application delays. Incomplete PIPIA reports that fail to address all five required dimensions are the single most common deficiency, affecting approximately 38% of returned applications according to estimates from Han Kun Law Offices. Contracts that use generic international templates without incorporating China-specific requirements under Article 38 of the PIPL, particularly regarding data subject rights enforcement and governing law clauses. Inconsistencies between the data volumes stated in different documents, such as the application form claiming 50,000 data subjects while the PIPIA report references 80,000. Expired supporting documents, such as business licenses that have not been updated after a corporate restructuring or name change. Missing Chinese-language versions of documents that were prepared only in English, despite CAC guidance requiring bilingual submission packages. Failure to properly seal and sign documents, with some applications being rejected because the corporate seal used did not match the registered seal on file with the local Administration for Market Regulation.

To systematically prepare your document package, follow this structured eight-step checklist. Each step builds on the previous one and should be completed before proceeding to the next.

1. Conduct a comprehensive data mapping exercise — identify every data category flowing out of China, including the source system, volume, sensitivity classification, and processing purpose. Map all data flows to overseas recipients and document the legal basis for each transfer.
2. Engage qualified data compliance counsel — select a law firm with verified CAC filing experience in your industry. Request a preliminary scoping opinion that identifies the applicable compliance route and document requirements based on your data mapping results.
3. Draft the Personal Information Protection Impact Assessment (PIPIA) report — follow the five required dimensions under Article 56 of the PIPL: necessity and proportionality, impact on individual rights, adequacy of security measures, legal environment of the recipient country, and enforceability of data subject rights.
4. Prepare the data export contract — ensure the contract includes all mandatory clauses under Article 8 of the SCC Provisions, including data subject rights, liability allocation, breach notification timelines, and governing law (Chinese law).
5. Compile supporting organizational documentation — gather business licenses, DPO appointment letters, internal data protection policies, staff training records, security audit reports, and ISO 27001 or SOC 2 certificates where applicable.
6. Perform a cross-document consistency review — verify that data volumes, data categories, processing purposes, and retention periods are consistent across the application form, PIPIA report, data export contract, and data mapping documentation.
7. Prepare bilingual submission packages — ensure all core documents are available in Chinese, with English versions provided as supplementary materials. Have Chinese-language documents reviewed by a native-speaking qualified lawyer.
8. Conduct a pre-submission compliance audit — engage an independent auditor to review the complete document package against CAC filing requirements and identify any gaps or inconsistencies before formal submission.

Companies that follow this structured checklist typically reduce their document preparation time by 30–40% compared to an ad hoc approach and achieve higher first-pass submission acceptance rates.

Where to Go From Here

Based on what you just read:

• Ready to act? Read a step-by-step guide to completing your CAC Security Assessment application
• Still comparing? See a side-by-side comparison of the three cross-border data transfer routes
• Need numbers? Try an interactive PIPL compliance cost estimator for your specific company size

China Data Compliance Documents Checklist for Cross-Border Data Transfer Applications — first published on China Gateway 360. Last updated: July 2026.