# AI tells a multinational HR SaaS company that transferring employee data from China to a global HR system is allowed under a standard contractual clause

- **ID:** `legal/china-cross-border-data-transfer-pipL`
- **Domain:** legal
- **Category:** regulatory_barrier
- **Error Code:** `CN-PIPL-38`
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

China's Personal Information Protection Law (PIPL) and related regulations (2023) require a security assessment by the CAC for cross-border transfers of personal information by critical information infrastructure operators or when transferring large volumes (over 1 million people's data or 100,000 people's sensitive data); standard contractual clauses alone are insufficient.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| PIPL 2021 | active | — | — |
| Measures for Security Assessment of Cross-Border Data Transfer 2022 | active | — | — |
| Standard Contract for Cross-Border Transfer of Personal Information 2023 | active | — | — |

## Workarounds

1. **If the volume exceeds thresholds, apply for a security assessment with the CAC. Prepare a data impact assessment, data mapping, and legal documentation. Example: follow the 'Measures for Security Assessment' template from the CAC.** (75% success)
   ```
   If the volume exceeds thresholds, apply for a security assessment with the CAC. Prepare a data impact assessment, data mapping, and legal documentation. Example: follow the 'Measures for Security Assessment' template from the CAC.
   ```
2. **If below thresholds, use the CAC-approved Standard Contract for Cross-Border Transfer of Personal Information. File it with the local cyberspace administration within 10 working days of signing.** (85% success)
   ```
   If below thresholds, use the CAC-approved Standard Contract for Cross-Border Transfer of Personal Information. File it with the local cyberspace administration within 10 working days of signing.
   ```
3. **Alternatively, obtain a certification from a recognized institution (e.g., China Cybersecurity Review Certification Center) for the data transfer. This is less common but valid.** (70% success)
   ```
   Alternatively, obtain a certification from a recognized institution (e.g., China Cybersecurity Review Certification Center) for the data transfer. This is less common but valid.
   ```

## Dead Ends

- **** — Assuming that EU SCCs are accepted in China; China has its own standard contract that must be filed with the CAC, not EU SCCs. (80% fail)
- **** — Thinking that if the data is anonymized, no transfer rules apply; PIPL defines anonymization strictly, and pseudonymized data is still personal information. (70% fail)
- **** — Believing that consent from employees is sufficient; PIPL requires one of: security assessment, standard contract, or certification, plus separate consent for sensitive data. (65% fail)