Guidelines for Filing the Standard Contract for Outbound Cross-Border Transfer of Personal Information (‘Guidelines’) is live now.
With the Measures for the Standard Contract for Outbound Cross-Border Transfer of Personal Information in effect from June 1, 2023, the Guidelines (effective from 30 May 2023) serve as a guide for companies filing the Standard Contract for Outbound Cross-Border Transfer of Personal Information (Standard Contract).
Companies should note the filing timeline and adjust contractual terms for any outbound personal information transmitted to suppliers accordingly.
Scope
Companies filling an executed Standard Contract shall meet the following criteria:
- not a critical information infrastructure operator;
- handles personal information of less than one million individuals;
- providess personal information less than 100,000 individuals in aggregate to overseas recipients since January 1 of the previous year; and
- provide sensitive personal information less than 10,000 individuals in aggregate to any overseas recipients since January 1 of the previous year.
Where it is otherwise provided in any law or administrative regulations, or by the national cyberspace authority, those provisions shall prevail.
Important Note
Personal information cannot be split into separate amounts to be transferred overseas or other manners.
Filing Method
The Standard Contract shall be filed at the local provincial-level cyberspace administration authority. And shall be filed within 10 working days from the effective date of the Standard Contract.
Filing Process
The filing process for a Standard Contract includes the submission of materials, the review of materials, feedback on the filing result, and supplementary filing or re-filing.
Submitting Materials
The below materials shall be submitted along with the electronic version.
- A photocopy of the Unified Social Credit Code Certificate;
- A photocopy of the legal representative’s identity card;
- A photocopy of the identity card of the filing agent;
- The Power of Attorney for the filing agent;
- A letter of undertakings;
- The standard contract; and
- A personal information protection impact assessment Report.
Review and Feedback
Review and notification of the filing result will be sent within 15 working days.
“Pass” or “Fail” Results
- For “Pass” results, a filing number will be issued to the company;
- For “Fail” results, the reason and any additional materials required will be provided, and the company should complete the materials and resubmit within 10 working days.
Supplementary Filing or Re-filing
- any change in the purpose, scope, category, sensitivity, method, or storage location of the personal information transferred overseas; or
- any change in the purpose or method of the personal information processing of the overseas recipient, or
- an extension of the overseas retention period of the personal information;
- any change in personal information protection policies and regulations in the country; or region where the overseas recipient is located, which may affect personal information rights and interests; or
- other circumstances that may affect personal information rights and interests.
Any supplement to a Standard Contract within the validity period shall be submitted as supplementary materials to the local provincial-level cyberspace administration authority.
Equally, if a Standard Contract is re-executed, then it shall be refiled. The materials submitted for supplementary filing or re-filing shall be reviewed within 15 working days.
Liability
Submitted materials shall be authentic. Any false materials will be deemed as failure to complete. Additionally, corresponding legal liability will be pursued according to the law.
Contact Us
If you would like more information about filling the Standard Contract, send us an email at talktous@horizons-advisory.com, and we’ll have a Horizons professional contact you.
