A Practical Guide: How To Really Make China's SCC Work For Your Business

Article 38 of the Personal Information Protection Law stipulates four compliance paths for the cross-border transfer of personal information, namely: (1) passing the security assessment organized by the Cyberspace Administration of China ("CAC"); (2) passing the protection certification by a specialized agency; (3) entering into a standard contract formulated by CAC; and (4) meeting other conditions set forth by laws and administrative regulations and by CAC.

On 24 February 2023, the CAC issued the Measures for Standard Contract for Cross-border Transfers of Personal Information (the "Measures"), which officially announced the implementation of the third of the "four ways" for cross-border transfer of personal information. In light of our practical experience, this article analyses the key elements of the Standard Contract for Cross-border Transfers of Personal Information (the "Standard Contract"), with the aim of assisting relevant enterprises in carrying out