Compliance with requirements on cross-border data transfers has
become increasingly important for businesses operating in China.
The Personal Information Protection Law (PIPL) mandates that
personal information (PI) processors conducting cross-border data
transfers must comply with one of three mechanisms: passing a
security assessment organized by the Cyberspace Administration of
China (CAC), concluding a standard contract with the overseas
recipient (China SCC), or obtaining personal information protection
certification from a specialized body.
On November 18, 2022, the CAC and the State Administration for
Market Regulation (SAMR) issued the Implementation Rules for
Personal Information Protection Certification (PI Certification
Rules). These rules outline essential principles and requirements
for certifying the collection, storage, usage, processing,
transmission, provision, disclosure, deletion, and cross-border
transfer of personal data. For cross-border PI
