Personal Information Export Certification: 2022 Framework vs. 2025 Measures

What changed

Material differences at a glance

The 2022 rules established the certification process and certificate lifecycle for personal-information protection, including cross-border processing. The 2025 measures add a dedicated departmental-rule basis for the export-certification route, define route eligibility, regulate overseas recipients and certification institutions, and connect the route to current cross-border data rules.

The 2025 measures expressly define who may use export certification and exclude important data.
The newer measures add dedicated obligations for processors, overseas recipients, certification bodies, and oversight authorities.
The existing three-year certificate term and six-month renewal window remain part of the certification framework rather than being newly created in 2025.

Source comparison

5 reviewed change records

Article / Section	Previous Text	Updated Text	Type	Practical Impact	Notes
Legal instrument	A 2022 joint announcement and implementation rules established the personal-information protection certification process.	CAC and SAMR Order No. 20 creates dedicated departmental measures for personal information export certification.	~ Modified	The export route now has a dedicated regulatory instrument in addition to certification rules and standards.	The instruments have related but different functions.Effective: 2026-01-01Current source
Route eligibility	The 2022 rules covered personal-information processing certification generally and added requirements for cross-border processing.	The 2025 measures specify non-CIIO eligibility and the 100,000 to below 1 million ordinary-PI or below 10,000 sensitive-PI ranges, subject to other rules.	+ Added	Creates a clearer route-selection condition for export certification.	2025 Measures Article 5; important data is excluded and splitting to evade assessment is prohibited.Effective: 2026-01-01Current source
Certificate lifecycle	The 2022 rules set a three-year validity period and application within six months before expiry for continued use.	The certification framework continues to use lifecycle, supervision, change, suspension, and withdrawal controls under the applicable certification rules.	i Clarified	Do not describe the three-year term or six-month renewal timing as first introduced in 2025.	2022 implementation rules section 5.1; read with current certification rules.Effective: 2026-01-01Previous source Current source
Processor and recipient duties	The 2022 framework required compliance with GB/T 35273 and the then-current cross-border certification specification.	The 2025 measures expressly address processor and overseas-recipient responsibilities, legal agreements, impact assessment, rights, incidents, and supervision.	+ Added	Operational certification preparation must cover both route eligibility and substantive cross-border safeguards.	Use the full 2025 official text and current standards for implementation.Effective: 2026-01-01Current source
Conflict rule	Earlier certification materials operated before the dedicated export-certification measures.	The 2025 measures state that inconsistent earlier provisions are superseded by the measures.	↔ Procedural	Current route analysis should prioritize the 2025 measures where earlier provisions conflict.	2025 Measures Article 18.Effective: 2026-01-01Current source

Official sources

Previous source Current source

This website is for informational and educational purposes only. It does not constitute legal advice. The Chinese text shall prevail. Users should consult qualified legal counsel for specific matters.

Search laws, regulations, standards and guides