CAC Releases First Batch of Q&A on Data Cross-Border Security Management Policies

On April 9, 2025, the Cyberspace Administration of China (CAC) released the Q&A on Data Cross-Border Security Management Policies (April 2025), clarifying the implementation paths for systems such as data cross-border security assessment, standard contracts for personal information export, and personal information protection certification.

The Q&A summarizes the research and responses to recent inquiries received by the administration, clearly stating that pilot free trade zones can formulate negative lists for data export to facilitate cross-border data flows. The necessity of personal information export must be assessed, and important data must undergo a security assessment before being exported. Foreign enterprises can participate in the formulation of industry technical standards. Group companies can consolidate applications for data export assessments to improve efficiency. The validity period of data cross-border security assessment results can be extended to three years.