{
  "id": "legal/china-pipl-cross-border-data-transfer",
  "signature": "AI tells a foreign company that they can freely transfer employee HR data out of China without an assessment or contract",
  "signature_zh": "AI告知外国公司可以自由将员工HR数据转移出中国，无需评估或合同",
  "regex": "(?i)(transfer|export).*(employee|HR|staff).*data.*(China|PIPL|out of China|cross.border)",
  "domain": "legal",
  "category": "regulatory_barrier",
  "subcategory": null,
  "root_cause": "China's Personal Information Protection Law (PIPL) Articles 38-40 require a security assessment, standard contract, or certification for cross-border transfer of personal information, with stricter rules for HR data (CII data).",
  "root_cause_type": "generic",
  "root_cause_zh": "中国《个人信息保护法》第38-40条要求跨境传输个人信息需进行安全评估、签订标准合同或获得认证，对HR数据（关键信息基础设施数据）有更严格规定。",
  "versions": [
    {
      "version": "PIPL 2021",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Measures for Cross-Border Data Transfer 2022",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Standard Contract Clauses 2023",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "PIPL requires de-identification that is irreversible; pseudonymization (replacing names with IDs) is still personal data if re-identification is possible.",
      "fail_rate": 0.8,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Remote access from abroad is considered cross-border transfer under PIPL; the storage location does not exempt the transfer.",
      "fail_rate": 0.75,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Consent alone is insufficient for CII data or large-scale transfers; a security assessment or standard contract is still mandatory.",
      "fail_rate": 0.85,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Use the China PIPL Standard Contract Clauses (SCC) published by the CAC; sign with each overseas recipient and file with the provincial cyberspace administration within 10 working days.",
      "success_rate": 0.82,
      "how": "Use the China PIPL Standard Contract Clauses (SCC) published by the CAC; sign with each overseas recipient and file with the provincial cyberspace administration within 10 working days.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Conduct a PIPL security assessment (if processing CII data or >1M persons' data) through the CAC's online portal; allow 3-6 months for approval.",
      "success_rate": 0.7,
      "how": "Conduct a PIPL security assessment (if processing CII data or >1M persons' data) through the CAC's online portal; allow 3-6 months for approval.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Keep HR data within China by using a local server or China-based cloud (e.g., Alibaba Cloud China region) and provide only aggregated, anonymized reports to headquarters.",
      "success_rate": 0.88,
      "how": "Keep HR data within China by using a local server or China-based cloud (e.g., Alibaba Cloud China region) and provide only aggregated, anonymized reports to headquarters.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "Use the China PIPL Standard Contract Clauses (SCC) published by the CAC; sign with each overseas recipient and file with the provincial cyberspace administration within 10 working days.",
    "Conduct a PIPL security assessment (if processing CII data or >1M persons' data) through the CAC's online portal; allow 3-6 months for approval.",
    "Keep HR data within China by using a local server or China-based cloud (e.g., Alibaba Cloud China region) and provide only aggregated, anonymized reports to headquarters."
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://www.gov.cn/zhengce/2021-08/20/content_5632502.htm",
  "official_doc_section": null,
  "error_code": "PIPL-Art38-CrossBorder",
  "verification_tier": "ai_generated",
  "confidence": 0.84,
  "fix_success_rate": 0.72,
  "resolvable": "partial",
  "first_seen": "2023-12-01",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}