Public source reference library for China data regulation
AlertsSource policyMy Library中文
China Data RegulationIndependent regulatory research

Research across the library

Search laws, regulations, standards and guides

Suggested searches

Current priorities

2026-07-03Revised Internet Information Service Measures draft2026-06-18Network data risk assessment: draft versus final

Source-verified comparison

Personal Information Export Certification: 2022 Framework vs. 2025 Measures

2022 personal information protection certification implementation framework and 2025 Personal Information Export Certification Measures

Previous version2022-11-04
Current version2025-10-14
Legal statuseffective
Effective date2026-01-01

What changed

Material differences at a glance

The 2022 rules established the certification process and certificate lifecycle for personal-information protection, including cross-border processing. The 2025 measures add a dedicated departmental-rule basis for the export-certification route, define route eligibility, regulate overseas recipients and certification institutions, and connect the route to current cross-border data rules.

  • The 2025 measures expressly define who may use export certification and exclude important data.
  • The newer measures add dedicated obligations for processors, overseas recipients, certification bodies, and oversight authorities.
  • The existing three-year certificate term and six-month renewal window remain part of the certification framework rather than being newly created in 2025.

Source comparison

5 reviewed change records
modified

Legal instrument

Previous rule summary
A 2022 joint announcement and implementation rules established the personal-information protection certification process.
Compared rule summary
CAC and SAMR Order No. 20 creates dedicated departmental measures for personal information export certification.

Practical impact: The export route now has a dedicated regulatory instrument in addition to certification rules and standards.

The instruments have related but different functions.

added

Route eligibility

Previous rule summary
The 2022 rules covered personal-information processing certification generally and added requirements for cross-border processing.
Compared rule summary
The 2025 measures specify non-CIIO eligibility and the 100,000 to below 1 million ordinary-PI or below 10,000 sensitive-PI ranges, subject to other rules.

Practical impact: Creates a clearer route-selection condition for export certification.

2025 Measures Article 5; important data is excluded and splitting to evade assessment is prohibited.

clarified

Certificate lifecycle

Previous rule summary
The 2022 rules set a three-year validity period and application within six months before expiry for continued use.
Compared rule summary
The certification framework continues to use lifecycle, supervision, change, suspension, and withdrawal controls under the applicable certification rules.

Practical impact: Do not describe the three-year term or six-month renewal timing as first introduced in 2025.

2022 implementation rules section 5.1; read with current certification rules.

added

Processor and recipient duties

Previous rule summary
The 2022 framework required compliance with GB/T 35273 and the then-current cross-border certification specification.
Compared rule summary
The 2025 measures expressly address processor and overseas-recipient responsibilities, legal agreements, impact assessment, rights, incidents, and supervision.

Practical impact: Operational certification preparation must cover both route eligibility and substantive cross-border safeguards.

Use the full 2025 official text and current standards for implementation.

procedural

Conflict rule

Previous rule summary
Earlier certification materials operated before the dedicated export-certification measures.
Compared rule summary
The 2025 measures state that inconsistent earlier provisions are superseded by the measures.

Practical impact: Current route analysis should prioritize the 2025 measures where earlier provisions conflict.

2025 Measures Article 18.

Official sources

Previous sourceCurrent source

Sources checked:

This website is for informational and educational purposes only. It does not constitute legal advice. The Chinese text shall prevail. Users should consult qualified legal counsel for specific matters.