Photo: VCG

The Measures for Personal Information Protection Certification for Cross-Border Data Transfers, jointly issued by the Cyberspace Administration of China (CAC) and the State Administration for Market Regulation, will take effect on January 1, 2026, the official WeChat account of the CAC said on Friday. Measures are aimed at protecting the rights and interests of personal information, regulating personal information outbound certification activities, and facilitating the efficient and secure cross-border flow of personal information, CCTV News reported.

The measures specify the applicable scenarios for personal information outbound certification, the application methods, certification requirements, and the validity period of the certification for personal information outbound transfers, according to CAC.

This specification ensures, to a certain extent, the security of personal information outbound transfers while simultaneously reducing the compliance burden on enterprises, said Zhao Jingwu, an associate professor from BeiHang University Law School.

The measures stipulate that personal information handlers shall apply for personal information outbound transfer certification to professional certification bodies, and professional certification bodies shall carry out certification activities in accordance with the fundamental certification standards and personal information protection certification rules, according to the report.

The certification is valid for a period of three years, CAC added.

The measures also specify the obligations to be fulfilled by professional certification bodies, stipulating that these bodies shall report information related to personal information outbound transfer certificates to the national public service platform for certification and accreditation information. 

The measures also stipulate that within 10 working days from obtaining certification qualifications, professional certification bodies shall file a record with the national cyberspace administration. The national market supervision and management department and the national cyberspace administration shall supervise the activities related to personal information outbound transfer certification.

When cyberspace administrations at the provincial level or above and relevant departments discover that the outbound personal information transfer activities of certified personal information handlers pose significant risks or have experienced personal information security incidents, they may, in accordance with the law, conduct interviews with the certified personal information handlers, said the CAC.

Zhao said this provision clearly defines the obligations to be fulfilled by professional certification bodies, constructing a certification implementation system with clear rights, responsibilities, and transparent operation.

It not only strengthens the standardization, professional responsibility, and social credibility of professional certification bodies but also enhances transparency and public trust in the certification process through information disclosure and filing management, thereby laying an institutional foundation for the authority of certification outcomes, Zhao added.

The regulatory model, characterized by clear division and complementarity, avoids functional overlap and resource waste while ensuring the controllability and responsiveness of the entire certification process, Zhao said. It fully demonstrates the enhancement of modernization in China's governance capabilities in the field of personal information protection, he added.

The measures also set forth provisions regarding legal liability for violations of the measures' stipulations and their applicable effect.

The introduction of the measures represents a major refinement of the legislative and regulatory framework in the area of personal information outbound transfers in China, signifying the completion of the construction of China's personal information outbound transfer institutional system, said Ding Xiaodong, deputy director of the Law and Technology Institute under the Renmin University of China.

He added that by integrating China's certification system with relevant legal provisions on personal information protection, the measures have formed a set of personal information outbound transfer certification rules that are tailored to China's national conditions, highly targeted, and operable. 

In the future, the implementation of the measures will facilitate the efficient cross-border flow of personal information on the basis of ensuring security, further invigorate the vitality of China's data factors, and provide a solid foundation for the development of China's digital economy, Ding said.



Global Times