Key Takeaways
- The third edition is filing guidance; it does not replace the legal trigger analysis.
- The official release states that filing materials were optimized and simplified.
- An eligible extension application may be made within 60 working days before expiry.
The third-edition guide is an operational filing document. It should be used only after a proposed transfer has been screened against the current security-assessment triggers in the controlling rules.
What Changed in the Third Edition
The CAC’s release says the third edition optimizes and simplifies the materials required for a security-assessment filing. It also addresses the conditions, process and materials for extending the validity of an assessment result.
The release does not state that the guide changes the legal triggers for a security assessment. Those triggers must still be checked against the Security Assessment Measures, the 2024 data-flow provisions and other applicable rules.
Before Preparing the Filing
Record the transfer purpose, data categories, estimated scale, data processor, overseas recipient and transfer arrangement. Determine whether important data, personal information, sensitive personal information or a regulated processor category is involved.
The route decision and the filing package are separate workstreams. A complete package does not cure an incorrect route decision.
Extension of an Assessment Result
The official release says an eligible processor may apply within 60 working days before the result expires. The July 2026 CAC Q&A explains that all stated conditions must be met. These include no relevant change in purpose, scope, parties or the legal document; the specified 20% growth limits; and compliant activity without a major data-security incident during the preceding three years.
The 20% limits address the future three-year increase in personal-information subjects and, for important data, the increase in the relevant data scale, measured against the quantities approved for the preceding three years.
Recommended Preparation Sequence
- Freeze the facts and document the route analysis.
- Use the current guide’s forms and materials list.
- Reconcile the application, impact assessment and legal document.
- Submit through the official data-export filing system.
- Preserve the submission record, regulator communications and the final result.
- Maintain change controls so that a new filing or extension question can be identified early.
Common Errors
- Treating the guide as the legal source for the assessment trigger.
- Reusing a superseded package without checking the current forms.
- Allowing the application and supporting documents to describe different parties, purposes or data.
- Treating the extension conditions as alternatives rather than cumulative requirements.
- Waiting until the final 60 working days to begin evidence collection.
Official Source Basis
Last source verification: 2026-07-30. The official Chinese source prevails. This editorial guide is not legal advice.