Privacy & Cybersecurity Law Blog

On July 24, 2026, the Cyberspace Administration of China (“CAC”) published an official Q&A related to administrative policies on cross-border data transfers. Below is a list of the questions published by the CAC, each with a summary of the CAC’s response.

Q1. How should personal information handlers effectively fulfill the obligation of notification and separate consent when transferring data overseas?

Pursuant to Articles 30 and 39 of the Personal Information Protection Law of China (“PIPL”), data handlers transferring personal information outside of China must inform individuals of specific details, including the foreign recipient’s identity, the purpose of the transfer, data categories involved and procedures for exercising rights, as well as obtaining separate consent to the transfer from the individual through explicit means (e.g., pop-up confirmations or written consent). If sensitive personal information is involved, handlers must also disclose the necessity of the transfer and the impact it may have on individual rights.

• Separate consent must be specific and explicit; it must not be bundled with consent to other personal information processing activities, nor may it be obtained through a “blanket” authorization.
• Methods for obtaining separate consent are described in GB/T 42574-2023, Information Security Technology—Implementation Guidelines for Notification and Consent in the Processing of Personal Information, and may take the form of a signed written document, a pop-up window confirmation or a reply via email or text message.
• Where the cross-border transfer of personal information falls under any of the circumstances listed in Article 13, Paragraph 1, Items 2 through 7 of the PIPL, the individual’s consent is not required. However, the obligation to provide notice regarding the cross-border transfer must still be fulfilled.

Q2. What conditions must be met to apply for an extension of the valid period for passed security assessments?

Under existing regulations, specifically Article 9 of the Provisions on Promoting and Standardizing Cross-Border Data Flows, a passed CAC security assessment remains valid for three years. Data handlers may apply for a three-year extension within 60 working days before expiration if six cumulative conditions are met:

• the purpose and scope of data export remain unchanged;
• the data handler and foreign recipient remain unchanged;
• for transfers of personal information, the projected volume of personal information to be transferred over the next three years does not increase by more than 20% compared with the approved volume over the previous three years;
• for transfer of “important data”, the projected volume of important data does not increase by more than 20%;
• the legal documents entered into with the overseas recipient comply with Article 9 of the Measures for the Security Assessment of Data Transfer Abroad; and
• the handler strictly complied with the original assessment approval and experienced no major data security incidents over the past three years.

These conditions remain the same as those requirements for extension of the validity of a CAC security assessment under the dedicated chapter of the Guidelines for Filing Security Assessments for Data Transfers Overseas (Third Edition), which the CAC issued on June 27, 2025.

This extension mechanism relieves companies whose original three-year approvals are expiring from having to perform a redundant full reassessment. Crucially, the 20% threshold applies to projected future growth rather than current volume, providing data handlers flexibility to self-evaluate and streamline compliance filings.

Q3.  In recruitment scenarios, how should the necessity of transferring domestic job applicants' resumes overseas be determined?

Under Article 6 of the PIPL, data processing must adhere to the principles of necessity and minimization.

• Where domestic job applicant resumes are shared with foreign headquarters or overseas affiliates, necessity depends on the degree of involvement in the hiring process, the number of individuals involved and the scope of personal information data items collected for use abroad.
• If the overseas entity does not participate in the local recruitment decision, transferring candidate resumes is not necessary and is therefore prohibited.
• If the foreign entity directly participates in the hiring decision, the transfer of candidates’ personal information is permitted only to the minimum extent needed and should be limited to data points strictly required for that decision. Any permissible export must follow appropriate legal mechanisms (e.g., CAC security assessment, standard contractual clauses or certification) and comply with notification, separate consent and Personal Information Protection Impact Assessment requirements.

Data handlers cannot rely on the legal basis of “HR management purpose” to export candidate resumes. Unlike existing employees, job applicants do not automatically fall under the cross-border HR exemption, requiring strict necessity evaluations for overseas candidate data flows.