A filing guide, not a new assessment trigger
Use the third edition to prepare and manage a security-assessment application once the route analysis establishes that assessment is required. A well-formatted package cannot remedy an incorrect route choice. The guide retains the assessment scope and exceptions of the 2024 framework; it does not make every international transfer subject to assessment.
The principal operational addition is a dedicated extension workflow and Annex 5, alongside a simplified initial application form. This article compares the complete second- and third-edition official downloads, including their annexes. The government-hosted third-edition copy linked below matches the CAC download byte for byte. The matrices are original explanations, not replacement filing forms.
- CAC, third-edition release of 27 June 2025 and official download
- Third-edition guide, Sections I–III and Annexes 1–5; Hunan government copy identical to the CAC download
- CAC, second-edition release and first attachment: Sections II–III and Annexes 1–4
- 2024 Cross-border Data Flow Provisions, Articles 3–9 and 13
What actually changed from the second edition
The comparison separates a new step, a changed template and an existing requirement. Both editions already use the online system, retain an offline route for CIIOs or unsuitable cases, and ask for eight categories of initial materials. It would be inaccurate to describe all eight categories, online filing or deduplicated person counts as new in 2025.
| Location | Verified difference | Practical consequence |
|---|---|---|
| Guide Section II | The third edition spells out registration, project creation, upload, progress checks and online supplementation; the second edition already required system filing. | Use the current system workflow, but do not claim a newly created filing route. |
| Annexes 1 and 3 | The second edition's application document contained a separate undertaking and form. The third edition uses an application form with the undertaking incorporated. | Replace the old package structure, not the responsibility for truthful and current evidence. |
| Annex 2 | The authorization template now covers initial filing or extension work, rather than only initial filing. | Ensure the handler's authority and authorization period cover the chosen work. |
| Annex 3 notes | The second edition expressly required merging scenarios covering the same individuals. That sentence is not retained in the third-edition notes. | Use the new template; do not infer permission to double-count or conceal related activities. Both versions retain person-based deduplication fields. |
| Annex 4, II(B)(4) | The transfer-link description now expressly names the provider's and recipient's network-system domains, network addresses and transfer methods. | Reconcile the network diagram and system inventory with the report, rather than describing only a business relationship. |
| Section III and Annex 5 | The third edition adds extension conditions, submission materials, review steps and a dedicated form. The second edition has four annexes and no equivalent dedicated extension section. | Build an extension file from the approved project and its operating record, not by resending the initial package unchanged. |
Eight material categories, one consistent activity
Annex 1 is a materials specification, not a substitute for checking each scenario. The table below groups the official requirements with our editorial consistency checks. Proposed owners and checks are working recommendations; they are not additional official forms or mandatory job titles.
| Material | Official requirement / role | Editorial cross-check |
|---|---|---|
| Entity registration document | Copy bearing the entity's official seal. | Match the entity name and code across the system, application and legal document. |
| Legal representative ID | Copy bearing the official seal. | Resolve changes of representative before relying on an old authorization. |
| Handler ID | Copy bearing the official seal. | Match the authorized handler and keep internal access limited to the filing team. |
| Authorization | Use Annex 2 for the appropriate initial or extension work. | Check signatures, seal, dates and the stated absence of sub-delegation rights. |
| Application form | Use Annex 3 and complete it in Chinese, including its undertaking. | The activity, recipient and person-count narrative must match the self-assessment. |
| Recipient legal document | Highlight export-related clauses. The Chinese version controls; if only another language exists, submit an accurate Chinese translation alongside it. | Map scope, retention, onward transfer and incident responsibilities to the actual architecture. |
| Risk self-assessment report | Use Annex 4 in Chinese; the assessed work must have been completed within the 3 months before filing. | Record identified problems, remediation and the reasons for the conclusion, not just policy names. |
| Other evidence | Provide evidence relevant to the assessment and any subsequent request. | Link each item to a factual claim or control; avoid unexplained duplicate bundles. |
Prepare the evidence before finalizing the forms
First, freeze a dated scenario inventory: provider, recipient, business purpose, fields, systems, access method, storage, retention and onward transfers. Keep the exemption and assessment-trigger analysis with this record. Translate business names consistently across the inventory, legal documents and the application.
Second, work through the self-assessment while the technical and contractual design can still change. Annex 4 asks for field-level necessity, security capability, recipient safeguards, legal commitments, risks and remediation. Explain the current-year deduplicated outbound count and forecast the next three years. These are different periods; do not add them together without explaining their relationship.
Third, reconcile the report with Annex 3, legal documents and supporting evidence, then obtain signatures and seals. The undertaking says the self-assessment was completed within the preceding 3 months and no material change occurred before filing. Treat this as a timing and change-control check, not simply a recent cover date. Disclose a third party's participation as required; the provider remains responsible for the report.
Do not combine the procedural clocks
Online filing is the normal route at sjcj.cac.gov.cn. The guide retains offline submission through the provincial CAC for CIIOs and other cases unsuitable for the system; its Annex 1 also requires corresponding electronic materials on optical disc for offline submissions. Check current handling instructions before delivery. No login or real filing is performed by this website.
Completeness is not substantive approval. Submission, acceptance, a supplement request and the final notice are different states. Keep the receipt, acceptance number, exact uploaded version and communications together so that the reviewer can reconstruct which facts were assessed.
| Stage | Clock / starting event | What it does not mean |
|---|---|---|
| Initial completeness | Provincial CAC: 5 working days from submission of the materials. | Passing this stage does not approve the transfer. |
| Acceptance | National CAC: 7 working days from receiving the provincial submission to decide acceptance and notify in writing. | The 7-day clock is not counted from the user's first upload. |
| Substantive assessment | Measures Article 12: generally 45 working days from written acceptance; complex cases and supplementation can extend the period. | No guaranteed total launch date by simply adding 5 + 7 + 45. |
| Reassessment request | Apply within 15 working days of receipt of an assessment result if disputing it; the reassessment conclusion is final under the guide. | An objection does not itself change the existing result. |
| Extension review | Provincial completeness: 5 working days. National decision: 20 working days from receipt of the provincial application, extendable for complexity or supplements. | This is an extension process, not the initial 45-day assessment clock. |
Six conditions must be considered together
The assessment result is normally valid for 3 years under the 2024 provisions. An eligible application may be made within the 60 working days before expiry and needs approval. Start the evidence review earlier than that window; the application does not automatically extend validity while a decision is awaited.
Section III of the third edition sets the following cumulative conditions, repeated in the July 2026 Q&A. For a category not involved, the extension form provides a not-applicable option; this does not authorize a new category or activity outside the original approval.
| Condition | Evidence question | Limit |
|---|---|---|
| Purpose and scope unchanged | Do the future activities still match the approved scenario and purposes? | A small volume increase cannot cure a different purpose. |
| Parties unchanged | Are the relevant entities the same as in the approved project? | A group affiliation is not proof of an unchanged recipient. |
| PI growth within 20% | Compare future three-year individuals with the previously approved three-year quantity. | Do not substitute actual historic exports for the approved baseline. |
| Important-data growth within 20% | Compare like-for-like approved and proposed volumes using consistent MB/GB/TB units. | Data volume and number of persons are separate measures. |
| Legal document compliant | Check all Article 9 contractual responsibilities against the current document. | An unchanged signature alone does not establish compliance. |
| Compliant operation; no major incident | Evidence the prior three years' compliance with the result notice and absence of a major data-security incident. | Do not replace the operating record with an unsupported assurance. |
Build a distinct extension package
The guide lists five extension material categories: the entity registration copy, legal-representative ID copy and handler ID copy, each of which need not be re-provided if unchanged; the Annex 2 authorization; and the Annex 5 extension application. Do not interpret the first three conditional omissions as permission to omit the authorization or application.
For a project originally filed online, use its extension action in the system. For an originally offline project whose extension can now use the system, the guide provides an extension entry using the original acceptance number. CIIOs and other unsuitable cases still submit offline. Keep the original notice and acceptance number available before starting.
Annex 5 asks by scenario about transfer links, storage systems, data centres and recipient uses, and provides space to explain changes. It also asks about controls, recipient performance, operations, incidents, penalties and regulatory investigations or remediation. A field that permits an explanation is not permission to bypass a re-filing trigger; assess the significance under the controlling measures.
Worked examples for the growth calculation
These examples illustrate arithmetic and decision limits, not approvals. Growth is (future approved-period proposal minus the original approved three-year baseline) divided by that original baseline. Check all six conditions and the underlying approved scope even where the arithmetic is within 20%.
| Hypothetical facts | Calculation | Conclusion to record |
|---|---|---|
| Approved 1,000,000 people; actual 600,000; proposed 1,200,000 | (1,200,000 − 1,000,000) / 1,000,000 = 20% | Meets the numerical ceiling only; actual 600,000 is not the denominator. |
| Approved 1,000,000; proposed 1,200,001 | 20.0001%, greater than 20% | Fails this extension condition even by one person; assess the appropriate new filing path. |
| Approved important-data volume 500 GB; proposed 600 GB | (600 − 500) / 500 = 20% | Only the volume limb passes; verify classification, units and all other conditions. |
| Growth 10%, but a new overseas recipient | The percentage is not the complete test. | The unchanged-parties condition is not met. Do not represent the activity as automatically extendable. |
Resolve mismatches before submission
A hypothetical project describes a customer-support purpose in the form but marketing analytics in the legal document, reports 800,000 people without distinguishing periods, and omits an overseas remote-access system from the architecture. These are substantive discrepancies. Correct the facts and affected analysis before formatting the final files; a cover letter saying they are equivalent is not enough.
Use a document register with a version, date, scenario identifier, evidence owner and source for each quantity. This is an editorial preparation method, not a prescribed official register. Reconcile recipient names, fields, declared purposes, rights arrangements, technical routes and retention periods across Annexes 3 and 4 and the legal document.
Follow the format specified by the CAC for each annex. Annex 3 and Annex 5 specify a 16-point fixed line spacing, while Annex 4 specifies 26 points for the report body, alongside their stated Chinese and Latin fonts and A4 settings. Do not apply the website's visual design or an English editorial template to the submission documents.
Keep the approved activity and its evidence connected
Record the exact scope, conditions, issue date and expiry date of the result notice. Maintain a change log for recipients, purposes, categories, volume, storage, onward transfers and foreign legal conditions, and review whether a change triggers a fresh assessment. The extension file should grow from this operating record, not be assembled from memory just before expiry.
This guide provides a selected substantive comparison, not a line-by-line reproduction of every template cell. It does not submit a project or predict an authority's decision. Use the official Chinese forms for actual filing, and the related route guide for the separate question of whether assessment is required.
Official sources & revisions
- CAC, third-edition release of 27 June 2025 and official download
- Third-edition guide, Sections I–III and Annexes 1–5; Hunan government copy identical to the CAC download
- CAC, second-edition release and first attachment: Sections II–III and Annexes 1–4
- Security Assessment Measures, Articles 5–9 and 12–14; use the 2024 rules for conflicting provisions
- 2024 Cross-border Data Flow Provisions, Articles 3–9 and 13
- CAC, July 2026 export Q&A, question 2 on the cumulative extension conditions
: Replaced the release-notice overview after recovering and reading both complete official DOCX guides. Added selected annex changes, an eight-category material matrix, staged clocks, all extension conditions, package boundaries and original worked examples. No official forms are reproduced or re-hosted.
Examples and working tables are original research aids, not official forms or legal advice.
Suggest a correction