In order to implement the implementation of China's Personal Information Protection Law, the Cyberspace Administration of China officially promulgated the Standard Contractual Measures for the Overseas Export of Personal Information to regulate the export of personal information.

If the system server used by a company is set up abroad, and its customer enters personal information into the company's service software from within China, it is considered "personal information export", and in accordance with the provisions of the Personal Information Protection Law of the People's Republic of China, it is necessary to take any of the following measures for the export of personal information abroad:

1. Pass the security assessment organized by the National Internet Information Department

2.Obtain "Personal Information Protection Certification" from a third-party professional organization

3. Conclude the Standard Contract for the Export of Personal Information (hereinafter referred to as the "Standard Contract") with the overseas recipient.

4. Other conditions stipulated by the State Internet Information Department.

The Measures released this time stipulate the scope of application of the "Standard Contract" for the export of personal information abroad, provide action guidelines for the conduct of personal information export, and clarify the template of the "Standard Contract". The Measures are formally implemented on June 1, 2023, requiring rectification to be completed within 6 months after implementation.

Standard Contractual Measures for the Exportation of Personal Information:

http://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm

Guidelines for the Filing of Standard Contracts for the Transmission of Personal Information (First Edition):

http://www.cac.gov.cn/2023-05/30/c_1687090906222927.htm