# AI告诉一家跨国HR SaaS公司，根据标准合同条款，允许将员工数据从中国传输到全球HR系统

- **ID:** `legal/china-cross-border-data-transfer-pipL`
- **领域:** legal
- **类别:** regulatory_barrier
- **错误码:** `CN-PIPL-38`
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

中国的《个人信息保护法》及相关法规（2023年）要求，关键信息基础设施运营者或传输大量数据（超过100万人数据或10万人敏感数据）时，跨境传输个人信息需经网信办安全评估；仅凭标准合同条款是不够的。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| PIPL 2021 | active | — | — |
| Measures for Security Assessment of Cross-Border Data Transfer 2022 | active | — | — |
| Standard Contract for Cross-Border Transfer of Personal Information 2023 | active | — | — |

## 解决方案

1. ```
   If the volume exceeds thresholds, apply for a security assessment with the CAC. Prepare a data impact assessment, data mapping, and legal documentation. Example: follow the 'Measures for Security Assessment' template from the CAC.
   ```
2. ```
   If below thresholds, use the CAC-approved Standard Contract for Cross-Border Transfer of Personal Information. File it with the local cyberspace administration within 10 working days of signing.
   ```
3. ```
   Alternatively, obtain a certification from a recognized institution (e.g., China Cybersecurity Review Certification Center) for the data transfer. This is less common but valid.
   ```

## 无效尝试

- **** — Assuming that EU SCCs are accepted in China; China has its own standard contract that must be filed with the CAC, not EU SCCs. (80% 失败率)
- **** — Thinking that if the data is anonymized, no transfer rules apply; PIPL defines anonymization strictly, and pseudonymized data is still personal information. (70% 失败率)
- **** — Believing that consent from employees is sufficient; PIPL requires one of: security assessment, standard contract, or certification, plus separate consent for sensitive data. (65% 失败率)