Measures on the Standard Contract for Outbound Transfer of Personal Information (Mainland China)

April 2023

Joyce Wen and Teresa Huang

The Personal Information Protection Law implemented in 2021 provides basic rules for the cross-border provision of personal information, in which the conclusion of a contract with an overseas recipient in accordance with the Standard Contract formulated by the Cyberspace Administration of China (“CAC”) is recognized as one of the legal ways of providing personal information abroad.  As for the Standard Contract, the Personal Information Protection Law does not specify detailed provisions.  The Measures on the Standard Contract for Outbound Transfer of Personal Information (hereinafter referred to as the “Measures”), issued on February 22, 2023, clarify the model of such Standard Contract, providing specific guidelines for providing personal information aboard.

1. Clarify the scope of application. The Measures stipulate that where a personal information processor provides personal information abroad by entering into a Standard Contract, it shall meet all the following conditions: (1) it is not a critical information infrastructure operator; (2) it processes the personal information of less than 1 million persons; (3) since January 1 last year, it has accumulatively provided the personal information of less than 100,000 persons abroad; and (4) since January 1 last year, it has accumulatively provided the sensitive personal information of less than 10,000 persons abroad. At the same time, the personal information processor shall not take such means as quantitative splitting.

2. Clarify the assessment obligations and filing obligations of personal information processors. A personal information processor shall, before providing personal information abroad, carry out an impact assessment on the protection of personal information (Article 5) and shall file with the provincial cyberspace administration within 10 working days after the Standard Contract comes into effect (Article 7).

3. The Annex of the Measures is a model Standard Contract, which provides for matters such as the contract-related definitions, basic elements, contractual obligations, the rights and related remedies of the subject of personal information, and formulates two appendices: a description of the outbound transfer of personal information and other terms agreed by both parties. It should be reminded that the Measures allow a personal information processor and an overseas recipient to agree upon other terms, but such other terms may not conflict with the Standard Contract.

As the Measures will come into effect on June 1, 2023, enterprises are hereby reminded that those who rely on the Standard Contract to provide personal information abroad should implement the relevant processes to meet the deadline and filing requirements of the Measures.


The contents of all newsletters of Shanghai Lee, Tsai & Partners (Content) available on the webpage belong to and remain with Shanghai Lee, Tsai & Partners. All rights are reserved by Shanghai Lee, Tsai & Partners, and the Content may not be reproduced, downloaded, disseminated, published, or transferred in any form or by any means, except with the prior permission of Shanghai Lee, Tsai & Partners.

The Content is for informational purposes only and is not offered as legal or professional advice on any particular issue or case. The Content may not reflect the most current legal and regulatory developments. Shanghai Lee, Tsai & Partners and the editors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The contributing authors’ opinions do not represent the position of Shanghai Lee, Tsai & Partners. If the reader has any suggestions or questions, please do not hesitate to contact Shanghai Lee, Tsai & Partners.