China Clarifies Requirements on Personal Information Protection Certification

On October 14, 2025, the Cyberspace Administration of China (CAC, 国家互联网信息办公室) and the State Administration For Market Regulation (SAMR, 国家市场监督管理总局) jointly issued the Measures on Certification For Cross-Border Transfer of Personal Information (Measures, 个人信息出境认证办法), which will take effect on January 1, 2026. The Measures are the final version of the draft for public comment published by the CAC on January 3, 2025, and present challenges and opportunities for businesses operating in or interacting with China.

Background

The Personal Information Protection Certification (PIP Certification, 个人信息保护认证) issued by CAC-Approved Certification Institutions (Certification Institution, 认证机构) is one of the three mechanisms — along with CAC Security Assessment (Security Assessment, 数据出境安全评估) and filing Standard Contractual Clauses (SCC Filing, 个人信息出境标准合同备案) — set forth under the Personal Information Protection Law (PIPL, 个人信息保护法) for the cross-border transfer of personal information.¹

PIP Certification aligns with the international practice, including the European Union’s General Data Protection Regulation (GDPR).² Unlike the Security Assessment and the SCC Filing, for which the CAC has released multiple regulations, rules, and practical guidance, to date there has been little guidance on how PIP Certification should be used for cross-border data transfer. We have summarized major existing rules and national standards relating to the PIP Certification process in Appendix A below.

Scope of Application

Article 5 of the Measures states that PIP Certification is applicable where the data processor:

• Is not a Critical Information Infrastructure Operator (CIIO)
• Has cumulatively transferred the personal information of more than 100,000 individuals and less than one million individuals overseas within a year, or has cumulatively transferred the sensitive personal information of less than 10,000 individuals overseas within a year

Note that data processors should not apply for PIP Certification to circumvent the Security Assessment by disaggregating data volume. Rather, data processors should review their ongoing and planned cross-border data transfers and determine which of the three cross-border data transfer mechanisms is most appropriate. The criteria for the use of these three mechanisms are set forth below:³

Key Steps For PIP Certification

1. Pre-Application Requirements

Article 6 of the Measures provides the requirements data processors should fulfill before applying for PIP Certification. First, data processors should inform and obtain separate consent from the individuals whose data will be transferred, which is the fundamental requirement for cross-border transfer of personal information laid out in the PIPL. In addition, data processors should perform a Personal Information Protection Impact Assessment (PIA) before applying for certification. The Measures list six areas of focus for a PIA (which are similar to the PIA required for SCC Filing), including:

1. The legality, legitimacy, and necessity of the purpose, scope, and method of processing personal information by both the personal information processor and the foreign recipient

2. The scale, scope, type, and degree of sensitivity of the personal information to be transferred abroad, and the risks that the cross-border transfer of personal information may impose on national security, public interests, and personal information rights

3. The obligations the foreign recipient commits to undertake, and whether its management and technical measures and capabilities could guarantee the security of the personal information to be transferred abroad

4. The risks of personal information being tampered with, damaged, leaked, lost, or illegally used after it has been transferred abroad, and whether there are adequate channels for protecting personal information rights

5. The impact of the personal information protection policies and regulations of the country or region where the foreign recipient is located on personal information security and personal information rights

6. Other matters that may affect the security of the cross-border transfer of personal information

2. Applying for PIP Certification

The application materials for PIP Certification should be submitted in accordance with the requirements set forth by the Certification Institutions, and may therefore vary from one institution to another. For example, the sample application form released by the China Cybersecurity Review, Certification and Market Regulation Big Data Center (CCRC, 中国网络安全审查认证和市场监管大数据中心), one of the main Certification Institutions in China, requires companies to provide information on data processors, foreign recipients, the personal information involved, and also to provide:⁴

• Business process, data flow diagrams, and descriptions relating to the cross-border data transfer (Section 3.3.2)
• Organizational structure, and roles and responsibilities of the departments involved in the cross-border data transfer (Section 3.4.3)
• A list of business systems involved in the cross-border data transfer and introductions of these systems’ frameworks and functions, including descriptions on the relationships between these systems and the data processor’s cross-border business activities (Appendix B)

After receiving the application materials, the Certification Institution shall determine the certification plan (认证方案), by considering the type and quantity of personal information involved and the scope of personal information processing activities involved. The Certification Institution will then inform the data processor of the certification plan.

3. Evaluation and Issuance of PIP Certification

Article 3 of the Implementation Rules for Personal Information Protection Certification (Implementation Rules, 个人信息保护认证实施规则) provides that the process for PIP Certification includes technical verification, on-site review, and post-certification supervision. When a Certification Institution performs the evaluation of the applicant’s overall personal information protection status, it will also follow its own certification rules in addition to the Measures, the Implementing Rules and other relevant regulations, guidance, and national standards. The Certification Institution may also engage third parties to perform the technical verifications.

PIP Certification is valid for three years. After obtaining a valid PIP Certification, data processors may transfer data abroad freely so long as the transfer (1) is within the scope of the PIP Certification and (2) conforms to the Certification Institution’s requirements. If the data processor needs to renew its PIP Certification, it shall file an application six months prior to the expiration of its current PIP Certification. Information on the issuance, renewal, and/or revocation of PIP Certifications, will be reported to the National Certification And Accreditation Information Public Service Platform (全国认证认可信息公共服务平台) by the Certification Institution.

4. Post-Certification Supervision

Article 4.5 of the Implementation Rules states that the Certification Institution should conduct routine supervision of valid PIP Certifications to ensure that data processors conform to the certification requirements. Additionally, Article 13 of the Measures provides that the SAMR and the CAC may perform spot checks on Certification Institutions, the certification assessment process, and the results of certification assessments.

Takeaways

The Measures provide practical guidance for companies operating in China. Many companies may be faced with a choice of whether PIP Certification or SCC Filing better suit their operations. We have therefore summarized the main differences between PIP Certification and SCC Filing for reference.

Some issues remain unresolved with regard to the implementation of PIP Certification. For example, the differences between the valid legal agreements regarding cross-border transfer, which were required in the Cybersecurity Standard Practice Guide, and the standard contractual clauses required by SCC filing are unclear. We expect further clarification from regulators on this and other issues as additional guidance and rules are issued.

Appendix A: List of Major Existing Rules and National Standards Relating to the Overall PIP Certification Process

For questions on this or any other subject, please reach out to the authors or any of their colleagues in Arnold & Porter’s Privacy, Cybersecurity & Data Strategy practice group.

© Arnold & Porter Kaye Scholer LLP 2025 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.