On 24 February 2023, the Cyberspace Administration of China
(CAC) issued the Measures for Standard Contracts for Outbound
Personal Information (Measures) and the Standard Contractual
Clauses (SCC), which will take effect on 1 June 2023 to guide
implementation of Article 38 of China's Personal
Information Protection Law (PIPL) focusing on cross-border
transfers of personal data.
Application of the Measures and SCC
China's PIPL establishes that companies that export personal
information overseas and meet certain criteria or thresholds, must
first complete a security assessment as per the Data Outbound
Security Assessment Measures (Assessment Measures); and this
must be filed with the CAC for approval. This applies when any of
the following criteria are met:
