China: Measures for the standard contract for outbound transfer of personal information – part one

Managing IP is part of Legal Benchmarking Limited, 4 Bouverie Street, London, EC4Y 8AX

Copyright © Legal Benchmarking Limited and its affiliated companies 2025

Accessibility | Terms of Use | Privacy Policy | Modern Slavery Statement

China: Measures for the standard contract for outbound transfer of personal information – part one

Sponsored by

Tahota logo.JPG
social-media-1635577 (1).jpg

In the first of a two-part series, Charles Feng, Lian Xue and Yifan Lu of Tahota outline the key features of China’s new measures for the cross-border sharing of personal information

On February 24 2023, the Cyberspace Administration of China (CAC) published the Measures for the Standard Contract for Outbound Transfer of Personal Information (the Measures). It also published its annexes of Standard Contract for Outbound Transfer of Personal Information (Standard Contract), which will be implemented from June 1 2023. The Measures were issued after the issuance of the Security Assessment Measures for Outbound Data Transfers in September 2022. The Measures, along with a security assessment and personal information protection certification, will be one of the three major approaches for the outbound transfer of personal information.

In comparison to the other two routes, the Standard Contract for personal information is widely regarded as having certain advantages. These include lower costs and an easier operation, with high reference and application value for enterprises with cross-border personal information transfers. In conjunction with the new Measures and the Standard Contract, there are the following key points that enterprises need to focus on in their compliance work for cross-border personal information transfer.

Salient features of the Standard Contract

Strict format contract

In comparison to previous drafts of the Measures and Standard Contract for public comments, the official version of the Standard Contract further restricted the autonomy of will. The domestic personal information processor and the overseas recipient must sign and perform in strict accordance with the terms provided by the CAC. In addition, only the CAC is authorised to amend and modify the Standard Contract. The Standard Contract of the Measures is complete and specific, covering various aspects including:

  • Basic information;

  • Obligations of personal information processors and overseas recipients;

  • Rights and obligations of subjects of personal information;

  • The relationship between laws and regulations of the receiving place and the performance of the Standard Contract; and

  • Remedies and liabilities for breach of contract.

In addition, the Measures clearly stipulate that enterprises must not make additional agreements or any other forms of documents that conflict with the terms of the Standard Contract.

Recordation of the Standard Contract

According to the Measures, personal information processors are required to file a recordal of the Standard Contract with their local cyberspace administration within 10 working days from the effective date of the Standard Contract. Compared to the security assessment, the application of the Standard Contract is ampler in terms of preparation time and simpler in terms of administrative procedures. For enterprises that meet the requirements of the Standard Contract, such a path is undoubtedly more convenient and flexible, which is an advantage.

Protection of rights of the owner of personal information

The Standard Contract embodies the rights and obligations of three parties, namely: the domestic personal information processor, the overseas recipient and the owner of personal information. The establishment of the Standard Contract between the domestic personal information processor and the overseas recipient as the contracting parties will have a direct impact on the rights of the owner of personal information. The Standard Contract provides the owner of personal information as:

  • A beneficiary, and

  • Authorised to sue the personal information processor and the overseas recipient directly.

The Standard Contract also facilitates litigation and remedies for the owner of personal information through joint and several liability clauses if infringement occurs.

Tahota would like to thank Jing-mei Luo for their contribution to the article.

more from across site and SHARED ros bottom lb

More from across our site

A comparison of the 2024 and 2025 editions of the Managing IP EMEA Awards reveals the firms and companies that have been dominating Europe’s IP market year after year
Tuesday's coverage includes BD tips for aspiring partners, and a foray into the world of SEPs
Exclusive data reveals law firms are failing to go above and beyond for their corporate clients, with in-house counsel saying advisers should consider more transparent billing processes
Arty Rajendra and Gary Moss discuss why ‘thorough and intense’ preparation, plus the odd glass of wine, led to a record FRAND victory for their client
Monday’s coverage includes news of a potentially 'game-changing' trademark development in China and how practitioners are using AI
Managing IP gives a taster of the numbers behind this year’s IP STARS trademark rankings, and looks back at our 2025 award winners
Updates from IP offices, the shifting requirements of in-house counsel, and news of London 2026 were among major talking points on Sunday
Etienne Sanz de Acedo discusses the association’s three-year plan, what he is looking forward to in San Diego, and why London came calling for 2026
Professionals from three organisations reveal what led them to sponsor Brand Action and why doing so can build camaraderie
The results of a UK government consultation on the exhaustion of IP rights and an annual review published by the EPO’s Boards of Appeal were also among the top talking points this week
Gift this article