# AI告诉外国公司，它可以在未经政府评估的情况下自由地将员工HR数据转移出中国

- **ID:** `legal/china-cyber-security-law-data-localization`
- **领域:** legal
- **类别:** regulatory_barrier
- **验证级别:** ai_generated
- **修复率:** 80%

## 根因

中国的《个人信息保护法》（PIPL）和《网络安全法》要求，关键信息基础设施运营者或处理大量数据的实体将个人信息（包括HR数据）跨境转移，必须经过国家互联网信息办公室（CAC）的安全评估，或使用标准合同或认证；违规者可能被处以高达年收入5%的罚款。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| PIPL (Personal Information Protection Law, 2021) | active | — | — |
| Cybersecurity Law of the PRC (2017) | active | — | — |
| Measures for Security Assessment of Cross-Border Data Transfer (2022) | active | — | — |

## 解决方案

1. ```
   Determine if your company is a Critical Information Infrastructure Operator (CIIO). If yes, you must undergo a CAC security assessment. File an application with the CAC through the provincial cyberspace administration, providing a data transfer impact assessment and a contract with the foreign recipient.
   ```
2. ```
   If you are not a CIIO and process fewer than 1 million individuals' data, use the standard contract published by the CAC (effective June 2023). File the contract with the provincial CAC within 10 working days of signing.
   ```
3. ```
   For HR data specifically, consider processing and storing the data within China using a local server or cloud provider (e.g., Alibaba Cloud in Shanghai). Only transfer aggregated, anonymized reports outside China after ensuring irreversible anonymization.
   ```

## 无效尝试

- **** — For critical information infrastructure operators or entities processing data of 1 million+ individuals, a CAC security assessment is mandatory regardless of SCCs; SCCs are only an option for smaller-scale transfers (90% 失败率)
- **** — PIPL defines personal information broadly; anonymization must be irreversible and the data must not be re-identifiable. Pseudonymized data is still considered personal information and is subject to the same rules (85% 失败率)
- **** — A DPA addresses data processing, not cross-border transfer; the transfer itself requires either a CAC assessment, a standard contract, or certification under PIPL Article 38 (95% 失败率)