China's cross-border data transfer regime is no longer a paper framework. The three-pathway framework of the Cyberspace Administration of China (CAC) security assessment, Standard Contract (SCC) filing, and Personal Information (PI) protection certification has been fully operational since 1 January 2026. Regulators have now shifted their focus decisively from rulemaking to implementation and enforcement.
2026 has been the year of enforcement, highlighted by a RMB 10 million fine against Ctrip, a landmark case against Dior, and sweeping new rules for both small and giant data processors. If your business moves personal data out of China — including HR files, customer records, or app data — here is what has changed, and what you need to do about it.
The three routes out of China
Every cross-border transfer of personal data now runs through one of three pathways:
| Pathway | Trigger | Applicability |
| CAC Security Assessment | Critical infrastructure operators; important data exports; PI exports over 1 million people (or sensitive PI over 10,000) | Mandatory |
| SCC Filing or Certification | PI exports of 100,000–1 million people, or sensitive PI under 10,000 | Choose SCC filing or certification |
| Exemptions | Small exports, contract necessity, HR management, emergencies | Notice, consent and PIA duties still apply |
Note: Exemptions are read narrowly — notice, consent and impact-assessment duties never go away.
Three headlines you need to know
1.Resumes are not covered by the HR exemption.
The CAC's 24 July 2026 Q&A caught multinationals off guard: sending a China-based applicant's resume overseas does not count as HR data management, meaning the HR exemption does not apply.
- If the overseas office has no role in hiring, the transfer is not permitted at all.
- If it does have a role, only the minimum data fields needed may be sent. You still require a valid transfer mechanism, explicit notice, separate consent, and a Personal Information Protection Impact Assessment (PIPIA).
Auto-forwarding resumes without that groundwork is now a severe enforcement risk.
2. Big platforms get a watchdog
On 7 August 2026, the CAC published for public comment the Provisions on Personal Information Protection by Large Personal Information Processors (Draft for Comment). These draft rules target processors handling data for over 10 million people.
- Self-Reporting: Hit the threshold and you must self-report to the CAC, which will publish a public list of designated Large Processors.
- Supervision Committee: Within six months, designated processors must establish a supervision committee. At least two-thirds must be external members (with a minimum of seven members total) holding real oversight of sensitive data and cross-border transfers.
3. Small processors get a break — large ones get scrutiny
On 22 July 2026, the CAC and the Ministry of Public Security jointly issued the Provisions on Simplified Measures for Personal Information Protection by Small-Scale Personal Information Processors, which took effect on 1 September 2026. These new rules give processors handling data for fewer than 100,000 people real relief:
- Simplified notice-and-consent (in some cases, simply handing over data after disclosure counts as consent).
- Self-assessment templates instead of full, complex audits and PIPIAs.
- A more forgiving approach to minor, first-time slip-ups.
- For some, a complete pass on standard export mechanisms.
However, baseline protections for sensitive PI and minors' data are expressly preserved, and the simplified audit cycle must still run at least once every five years.
4. One breach, one full audit — just ask Dior
Dior (Shanghai)’s September 2025 penalty followed a May 2025 routine breach that exposed customer data sent to Paris. The data had been transferred without a valid transfer mechanism, adequate notice, separate consent, or encryption.
The lesson is clear: regulators do not stop at the breach itself. An incident, complaint, or inquiry can serve as an entry point for a full review of a company’s data governance framework, extending well beyond the immediate issue to its cross-border transfer mechanisms, consent records, impact assessments, and related compliance practices.
Do not wait for a breach to find out your transfer mechanism is non-existent. We help businesses map their China data flows, choose the right transfer route, build robust PIPIAs that hold up to regulatory scrutiny, and respond fast when an incident turns into an investigation.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
