中文研究版
个人信息出境认证2022 年实施规则与 2025 年认证办法
Personal Information Export Certification: 2022 Framework vs. 2025 Measures
比较认证适用范围、门槛、有效期、续期与监督机制的制度演进。
版本变化
重要变化概览
2022 personal information protection certification implementation framework and 2025 Personal Information Export Certification Measures
The 2022 rules established the certification process and certificate lifecycle for personal-information protection, including cross-border processing. The 2025 measures add a dedicated departmental-rule basis for the export-certification route, define route eligibility, regulate overseas recipients and certification institutions, and connect the route to current cross-border data rules.
- The 2025 measures expressly define who may use export certification and exclude important data.
- The newer measures add dedicated obligations for processors, overseas recipients, certification bodies, and oversight authorities.
- The existing three-year certificate term and six-month renewal window remain part of the certification framework rather than being newly created in 2025.
来源核验：
Legal instrument
- 此前规则摘要
- A 2022 joint announcement and implementation rules established the personal-information protection certification process.
- 对照规则摘要
- CAC and SAMR Order No. 20 creates dedicated departmental measures for personal information export certification.
实际影响：The export route now has a dedicated regulatory instrument in addition to certification rules and standards.
The instruments have related but different functions.
Route eligibility
- 此前规则摘要
- The 2022 rules covered personal-information processing certification generally and added requirements for cross-border processing.
- 对照规则摘要
- The 2025 measures specify non-CIIO eligibility and the 100,000 to below 1 million ordinary-PI or below 10,000 sensitive-PI ranges, subject to other rules.
实际影响：Creates a clearer route-selection condition for export certification.
2025 Measures Article 5; important data is excluded and splitting to evade assessment is prohibited.
Certificate lifecycle
- 此前规则摘要
- The 2022 rules set a three-year validity period and application within six months before expiry for continued use.
- 对照规则摘要
- The certification framework continues to use lifecycle, supervision, change, suspension, and withdrawal controls under the applicable certification rules.
实际影响：Do not describe the three-year term or six-month renewal timing as first introduced in 2025.
2022 implementation rules section 5.1; read with current certification rules.
Processor and recipient duties
- 此前规则摘要
- The 2022 framework required compliance with GB/T 35273 and the then-current cross-border certification specification.
- 对照规则摘要
- The 2025 measures expressly address processor and overseas-recipient responsibilities, legal agreements, impact assessment, rights, incidents, and supervision.
实际影响：Operational certification preparation must cover both route eligibility and substantive cross-border safeguards.
Use the full 2025 official text and current standards for implementation.
Conflict rule
- 此前规则摘要
- Earlier certification materials operated before the dedicated export-certification measures.
- 对照规则摘要
- The 2025 measures state that inconsistent earlier provisions are superseded by the measures.
实际影响：Current route analysis should prioritize the 2025 measures where earlier provisions conflict.
2025 Measures Article 18.