Key Takeaways
- Article 39 notice and separate consent are distinct requirements.
- The assessment-extension conditions described in the Q&A are cumulative.
- Recruitment transfers must be necessary and limited to the decision being made overseas.
The July 2026 CAC Q&A addresses three operational questions: Article 39 notice and consent, extension of a security-assessment result, and necessity in recruitment transfers.
Notice and Separate Consent
The Q&A identifies the overseas recipient, contact details, processing purpose, processing method, personal-information categories and the route for exercising rights among the matters to be disclosed.
Separate consent must be specific. It may not be bundled with other processing activities or obtained through blanket authorization.
Where the processing activity falls within another legal basis in PIPL Article 13(1)(2)-(7), consent may not be required, but the export notice obligation remains. Sensitive personal information also engages the additional notice described in PIPL Article 30.
Extension Conditions
The Q&A states that the conditions are cumulative. It reiterates the 60-working-day application window and explains the no-change, documentation, growth-limit and compliance-history conditions.
For personal information, the stated 20% limit addresses the future three-year increase in the number of natural persons compared with the quantity approved for the preceding three years. The Q&A separately addresses a 20% scale increase for important data.
Recruitment Transfers
Necessity depends on whether the overseas headquarters or affiliate actually participates in the hiring decision. If it does not, the Q&A says the export is not necessary.
Where it does participate, the people and data fields transferred should be limited to the minimum needed for that decision. The applicable transfer route, notice, separate consent where required, and impact-assessment duties remain separate questions.
Implementation Checklist
- Separate the Article 39 notice from the mechanism used for the transfer.
- Record the legal basis for the underlying processing and for consent, if applicable.
- Treat every extension condition as a required check.
- Document why an overseas recruitment decision needs the specific applicants and fields transferred.
- Revisit the route if the facts, recipient or data scope changes.
Official Source Basis
Last source verification: 2026-07-30. The official Chinese source prevails. This editorial guide is not legal advice.