PIPL: moving personal data out of China, the three routes in 2026

On 28 October 2026, China’s cyberspace regulator (China · CAC) published a third list of 21 bodies certified to carry out compliance audits under the Personal Information Protection Law, the PIPL. The signal matters more than the list. Since 1 January 2026, certification has had its own implementing measures, as the security assessment and the standard contract did before it, and the largest data handlers are now audited.

For a foreign company operating in China, the question is no longer whether it can transfer data. The question is by which route, for what volume, and with what evidence.

What is already settled

• Three standard routes (China · NPC Standing Committee, PIPL, Article 38): since 1 November 2021, any transfer of personal data out of China goes through a security assessment organised by the CAC, a certification or a standard contract, unless another condition is set by law or by the CAC. Article 39 requires that individuals be informed and give separate consent.
• The standard contract (China · CAC): applicable since 1 June 2023. It follows an impact assessment and is filed with the provincial CAC office within 10 working days of taking effect.
• The March 2024 relaxation (China · CAC): the provisions of 22 March 2024 exempt transfers needed to perform a contract with the individual, for cross-border HR management or in an emergency, as well as those covering fewer than 100,000 people a year, excluding sensitive data. A security assessment is now only required from one million people, from 10,000 people for sensitive data, for any “important data” and for critical infrastructure operators. In between: standard contract or certification. A successful assessment is valid for three years and can be renewed.
• Certification (China · CAC and SAMR, the market regulator): already provided for by the PIPL and the March 2024 provisions, it now has its own measures, signed on 14 October 2025 and applicable since 1 January 2026. Reserved for the middle band, it yields a certificate valid for three years. Splitting volumes to avoid an assessment is expressly prohibited.
• Compliance audits (China · CAC): mandatory since 1 May 2025, at least every two years for handlers processing the data of more than 10 million people. Authorities can also require one in case of high risk or an incident.
• Free trade zones (China · CAC): by March 2026, nine pilot free trade zones or free ports had published a “negative list” covering 22 sectors, including automotive, retail, civil aviation and reinsurance. For a company in the zone, data not on the list leaves without any transfer formality.

What is still in progress

• Targeted inspections (China · CAC): a special inspection of transfers by key companies and institutions has been carried out, with penalties announced but not quantified in the review of 23 March 2026.
• Local pre-assessment (China · CAC): eight provincial-level regions, including Fujian, Shandong and Chongqing, join the six pilots (Beijing, Shanghai, Guangdong, Tianjin, Jiangsu, Zhejiang) that review files before they are submitted.
• Certification capacity (China · CAC): three bodies are authorised to certify transfers. Whether they can absorb demand remains to be seen.
• Dialogue with Europe (China · CAC and EU · European Commission): the China–EU exchange mechanism on data flows held its second meeting in Brussels on 17 July 2025. As far as we know, no mutual recognition has been announced.

The real issue: evidence, more than paperwork

Published penalties target a missing data map more than a missing form. On 15 September 2026, the CAC made public the case of a Shanghai company that, since 2022, had been sending its users’ names, phone numbers, email addresses, dates of birth and passwords to data centres abroad, without a security assessment. The local CAC office ordered it to comply and fined it, without publishing the amount.

The legal ceiling remains a deterrent: for serious violations, the PIPL provides for up to RMB 50 million or 5% of the previous year’s revenue. The risk is not choosing the wrong route; it is not knowing which flows exist. A customer support tool, a global CRM or an AI service hosted outside China are all transfers.

Three points to watch

1. The counter resets every 1 January. Thresholds are cumulative from the start of the calendar year. A project launched in September can push a flow from one band to the next, and so change the route required.

2. An exemption does not remove other obligations. It waives the transfer mechanism, not the impact assessment the PIPL requires for any transfer (Article 55), nor the duty to inform individuals. It never covers important data.

3. Certification is not a ceiling. It only applies to the middle band. If volumes reach one million people during the year, a security assessment becomes mandatory again. And the certificate can be suspended, then revoked, if actual transfers go beyond the certified scope.

What a data handler should do

1. Map outbound flows from China: purpose, recipient, country, data categories, number of people, with an annual counter.
2. Classify each flow: exemption, standard contract, certification or security assessment, with the reasoning written down.
3. Document exemptions: contractual or HR necessity must be demonstrable, flow by flow.
4. Keep impact assessments up to date and file each standard contract within 10 working days.
5. Compare standard contract and certification: the contract is signed and filed recipient by recipient; the certificate, valid for three years, covers a scope audited by an authorised body.
6. Check the free trade zone negative list if the Chinese entity is registered there.
7. Plan the compliance audit above 10 million people, and prepare the evidence in every case: it can be required after an incident.

In China, a data transfer is justified by a route, a volume and evidence.

The question to ask on Monday morning

To your China compliance lead: “How many people have our outbound flows covered since 1 January, and which route does each of them use?”