The Three Approved Transfer Routes and Their Renewal Cycles

Cross-border data transfer filings in China must be renewed every 2 years for the CAC Security Assessment route, while Standard Contractual Clauses (SCCs) remain valid for up to 3 years and require refiling only if material changes occur. The renewal period for the third route — CNCA cross-border transfer certification — varies by certification body but is typically 2-3 years with annual monitoring audits. With approximately 8,500 cross-border data transfer filings submitted through all three routes since the PIPL took effect in 2021, and an estimated 2,100 of those reaching or approaching their first renewal deadline in 2026, foreign companies operating in China face an increasingly active compliance calendar. Missing a renewal deadline can invalidate your transfer authorization and expose your company to penalties of up to RMB 50 million or 5% of annual revenue under PIPL Article 66.

The Three Approved Transfer Routes and Their Renewal Cycles

Under the Personal Information Protection Law (PIPL, 个人信息保护法, gèrén xìnxī bǎohù fǎ) Article 38, organizations that need to transfer personal information outside of China must use one of three approved routes. Each route has different validity periods and renewal requirements that foreign companies must track carefully to maintain continuous compliance.

The CAC Security Assessment (安全评估, ānquán pínggū) is required for CIIOs (Critical Information Infrastructure Operators, 关键信息基础设施运营者, guānjiàn xìnxī jīchǔ shèshī yùnyíng zhě) and organizations processing the personal information of more than 1 million individuals annually. Once approved, the security assessment is valid for 2 years from the date of the CAC’s approval notice. The renewal application must be submitted at least 60 working days before expiry. The assessment process itself takes approximately 45-90 working days from submission to decision, meaning the renewal cycle should begin approximately 6 months before your current approval expires to ensure continuous coverage.

The Standard Contractual Clauses (SCCs, 标准合同条款, biāozhǔn hétong tiáokuǎn) route, governed by the Measures on Standard Contracts for Cross-Border Transfer of Personal Information (2023), does not have a fixed validity period. However, the contract must remain in effect for the duration of the data transfer activity. A material change in any contractual terms or circumstances requires a new SCC filing. The CAC recommends that companies review and if necessary refile their SCCs every 3 years from the effective date, even if no material changes have occurred, to ensure alignment with evolving regulatory interpretations.

The CNCA Cross-Border Transfer Certification (认证, rènzhèng) route requires certification by a CAC-approved certification body. Certifications are typically valid for 2-3 years, depending on the certification body. Annual surveillance audits are required during the validity period. Renewal requires a full recertification process, typically starting 3-6 months before expiry.

What Triggers a Refiling Before the Scheduled Renewal?

Even before your standard renewal period expires, certain triggering events require an immediate refiling or notification to the CAC. Under the Measures for Security Assessment of Cross-Border Data Transfers (updated March 2026), Article 13 specifies that the security assessment approval becomes invalid and a new application must be submitted when: the purpose, method, scope, or type of personal information or important data being transferred changes; the data recipient or the country/region where data is received changes; the data retention period overseas changes; or any material change occurs that may affect the security of the cross-border data transfer.

For the SCC route, the Measures on Standard Contracts (Article 8) require that if a material change occurs during the contract term — including changes to data transfer purpose, data categories, retention period, technical and organizational measures, or applicable laws in the recipient country — the controller must re-execute the contract and file a new SCC with the provincial CAC office within 30 working days. Practical examples of triggering events include: your company changes its global cloud provider for China-related data storage (change in data recipient); your China subsidiary begins collecting a new category of employee or customer data previously excluded from the transfer scope; or your overseas headquarters implements a new data analytics program that changes the purpose for which transferred data is processed.

Step-by-Step Renewal Process for the CAC Security Assessment

1. Begin the renewal process 6 months before expiry — The 60 working-day lead time (approximately 3 calendar months) plus the assessment processing time of 45-90 working days means the entire cycle takes 4-7 months. Starting 6 months before expiry provides adequate buffer for document preparation and regulator follow-up.
2. Prepare updated documentation — Gather: the original security assessment approval notice, an updated data transfer impact assessment (DPIA, 个人信息保护影响评估, gèrén xìnxī bǎohù yǐngxiǎng pínggū), an updated data flow map, a self-assessment report demonstrating continued compliance, and updated contracts with the overseas data recipient.
3. Submit via provincial CAC office — File the renewal application with the provincial-level CAC office where your company is registered. Include all supporting documents in both Chinese and English, with the Chinese version taking legal precedence.
4. Respond to CAC queries — During the assessment period, the CAC may request supplementary materials. Common queries include justification for the volume of data being transferred, explanation of why data cannot be processed domestically, and details of data security measures at the recipient side.
5. Receive renewal decision — The CAC will issue a new approval notice (valid for another 2 years), request modifications, or deny the renewal. If denied, the company must cease cross-border transfers and implement an alternative solution.

SCC and CNCA Certification Renewal

For Standard Contractual Clauses, if no material changes have occurred, you may continue operating under the existing SCC, though the CAC recommends a formal review every 3 years. If a material change triggers refiling, prepare an updated SCC and file it with the provincial CAC office within 30 working days. No formal approval is required — the SCC becomes effective after filing, but the CAC may request modifications within 15 working days.

CNCA certification renewal requires a full recertification process. Begin at least 6 months before expiry. The process includes engaging a CAC-approved certification body (as of July 2026, 14 certification bodies are approved, including CQC, CESI, CCID, and TÜV Rheinland China), submitting updated documentation, undergoing an on-site or remote audit (typically 2-5 days), and addressing non-conformities. Recertification costs range from RMB 50,000 to RMB 200,000 per certification cycle.

Consequences of Missing a Renewal Deadline

Operating a cross-border data transfer after your filing has expired constitutes an unauthorized transfer under PIPL Article 38, exposing your company to penalties under Article 66: fines of up to RMB 50 million or 5% of prior year’s annual revenue, confiscation of illegal gains, suspension of related business activities, and potential delisting from Chinese app stores. Responsible individuals face fines of RMB 100,000 to RMB 1 million and a professional ban of up to 10 years. The CAC’s 2025 enforcement report recorded 23 enforcement actions specifically related to expired or unauthorized cross-border data transfers, with an average penalty of RMB 3.8 million per case.

Compliance Calendar Management Best Practices

Managing cross-border data transfer renewal deadlines requires a systematic approach. Leading foreign companies implement a centralized compliance calendar tracking all regulatory deadlines across PIPL, DSL, CSL, and industry-specific regulations. For each filing, record the approval date, expiry date, and renewal lead time deadlines (6 months, 3 months, and 60 working days before expiry).

Conduct quarterly data flow reviews to identify material changes that would trigger early refiling. Establish an internal notification protocol requiring any business or technology team proposing changes that could affect cross-border data flows to flag the change to the data compliance team before implementation. Retain PRC-licensed data compliance counsel on a retainer basis for ongoing regulatory monitoring. Budget RMB 200,000-500,000 annually for external counsel depending on the complexity of your data profile.

Recent 2025-2026 Regulatory Changes Affecting Renewals

The March 2026 update to the Measures for Security Assessment of Cross-Border Data Transfers introduced a tiered renewal process. For low-risk data transfers that have not changed materially since the initial assessment, renewal documentation requirements are reduced — a streamlined self-assessment report replaces the full DPIA. The updated measures also introduced a deemed renewal provision for certain categories of non-personal business data transfers in pilot FTZs, where no formal renewal application is required if the transfer profile has not materially changed.

The CAC’s Data Export Facilitation Measures (January 2026) exempted certain categories of cross-border business data from the renewal requirement entirely in designated FTZs, including supply chain logistics data, manufacturing operations data, and aggregated analytics data that does not contain personal information or important data. Foreign companies operating in FTZs should check with their zone management authority to determine eligibility.

Where to Go From Here

Managing cross-border data transfer filing renewals requires disciplined calendar management and proactive compliance monitoring. Begin by auditing your current transfer routes and approaching deadlines, then implement a systematic renewal tracking process.

• [guide: SLUG-TO-BE-FILLED] — Step-by-step guide to CAC security assessment renewal
• [comparison: SLUG-TO-BE-FILLED] — SCCs vs Security Assessment: which cross-border data route for your China business
• [tool: SLUG-TO-BE-FILLED] — Cross-border data transfer route selection tool for foreign firms

How often do I need to renew my cross-border data transfer filing in China? — first published on China Gateway 360. Last updated: July 2026.