Measures for the Standard Contract for Outbound Cross-Border Transfer of Personal
Information
Effective
region
Promulgation 2023-02-22
date
NATIONAL
Document Ordre of the Cyberspace Administration
number
of China No.13
Effective
Effective
2023-06-01
Effectiveness
date
Contract ( Civil Law->Contract ) ,Computer & Internet ( Science & Technology Law->Computer &
Taxonomy
Internet )
Industry
Software & Information Technology
category
Promulgator Cyberspace Administration of China
Measures for the Standard Contract for Outbound Cross-Border Transfer of Personal Information
Ordre of the Cyberspace Administration of China No.13
February 22, 2023
The Measures for the Standard Contract for Outbound Cross-Border Transfer of Personal Information,
adopted at the 2nd office meeting of the Cyberspace Administration of China in 2023 on February 3, 2023,
are hereby issued and shall come into force on June 1, 2023.
Zhuang Rongwen, Director of the Cyberspace Administration of China
Measures for the Standard Contract for Outbound Cross-Border Transfer of Personal Information
Article 1 The Measures are formulated in accordance with the Personal Information Protection Law of the
People's Republic of China and other laws and regulations to protect personal information rights and
interests and regulate the outbound cross-border transfer of personal information.
Article 2 The Measures apply to the provision of personal information to any recipient outside of the territory
of the People’s Republic of China by a personal information processor under a standard contract for
outbound cross-border transfer of personal information executed with such overseas recipient (hereinafter
referred to as the “Standard Contract”).
Article 3 Where personal information is transferred overseas under a Standard Contract, a practice of
independent contracting combined with compliance with the record-filing requirement, and protection of
rights combined with prevention of risks shall be maintained to ensure a secure and free flow of personal
information across borders.
Article 4 To provide personal information to an overseas recipient through a Standard Contract executed, a
personal information processor shall meet the following criteria:
(1) not being a critical information infrastructure operator;
(2) handling personal information of fewer than one million individuals;
1