Provisions on Promoting and Regulating Cross-border Data Flows
Defines exemptions and conditions for outbound-data security assessment, standard contracts and certification.
Overview
Determine the applicable procedure by data content, processor status, transfer purpose and cumulative headcount.
Key points
01
Manufacturing data
Manufacturing and similar transfers containing neither personal information nor important data are exempt from the three procedures.
Article 302
Employee data and headcount
Necessary employee data for lawful cross-border HR management may qualify for exemption. Other personal data follows status, sensitivity and headcount conditions.
Articles 5, 7–803
Ongoing protection duties
Procedural exemptions do not remove applicable notice, separate consent, impact assessment or data-security duties.
Articles 10–11