On 22 Feb. 2023, the Cyberspace Administration of China (CAC) issued the “Measures for Standard Contract for Personal Information Export” (hereinafter the “Measures”, 個人信息出境標準合同辦法) and the "Standard Contract for Personal Information Export” (hereinafter the “Standard Contract”個人信息出境標準合同)
In accordance with Article 38 of the Personal Information Protection Law, where a personal information processor transmits personal information abroad, it shall adopt any of the following three approaches: a) to pass the security assessment; b) to obtain the protection authentication; or c) to sign a standard contract.
The Measures is for the purpose of the approach c ‘to sign a standard contract’. Specifically:
- The personal information processor may agree on other terms with the overseas recipient, provided that such terms do not conflict with the Standard Contract.
- The personal information export shall not be carried out until the Standard Contract becomes effective.
- The personal information processor shall file with the local provincial cyberspace administration within 10 working days from the effective date of the Standard Contract.
The CAC’s Standard Contract mainly includes the definition and basic elements of the Contract, the contractual obligations of the personal information processor and the overseas recipient, the impact of policies and regulations on the personal information protection in the overseas recipient’s country or region on the performance of the contract, the rights of the personal information subject and related remedies, as well as the cancellation of the contract, liability for breach of contract, dispute resolution and other matters. In addition, the Standard Contract also includes two appendices including the personal information export instructions and other terms agreed by both parties.
Cover Photo by volc xia on Unsplash
Contributors: CJO Staff Contributors Team
