Cross-Border Data Transfer: Order and CRM Data Under Chinese Law

If you run an e-commerce operation or manage a CRM database in China, your china data export ecommerce crm compliance question comes down to three thresholds: under 100,000 individuals exported annually is typically exempt, 100,000 to 1 million requires a standard contract or certification, and above 1 million triggers a mandatory government security assessment under the 2024 Provisions on Promoting and Regulating Cross-Border Data Flows.

Quick Facts

What Counts as a Cross-Border Data Transfer Under Chinese Law?

You will typically need to treat data as "exported" even when it never physically leaves China. Under the 2024 Provisions, providing data to a foreign party includes situations where data remains in China but is accessible or processable from overseas — for example, a US headquarters logging into a China-hosted CRM system remotely. This definition, confirmed in the Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Decree No. 16), captures the most common scenario for foreign-invested e-commerce brands: a Shanghai-based team using a SaaS CRM whose servers sit in Singapore or Virginia.

Practically, this means three data flows trigger analysis: order data sent to an overseas fulfillment or payment partner, CRM records synced to a global marketing platform, and remote access by overseas staff to China-resident customer records. Each flow is assessed separately, and volumes are counted cumulatively from January 1 of the current year.

Which Order and CRM Data Flows Are Exempt From Filing?

You may be exempt from all three formal pathways in six situations set out in the 2024 Provisions. The most relevant for e-commerce operators are summarized below.

Two nuances matter for order data. First, the contract-performance exemption covers the transaction itself — order confirmation, shipping labels, payment settlement — but it does not waive the separate obligations under the Personal Information Protection Law (PIPL) to inform individuals and obtain separate consent for cross-border transfer. Second, if your data has not been designated or publicly announced as "important data" by a competent authority, you do not need to treat it as such for filing purposes, per the same Provisions.

Which Pathway Applies to My CRM Data Volume?

You will typically need to map your annual export volume against three tiers. The thresholds below apply to non-critical information infrastructure operators (non-CIIO), which covers most foreign-invested e-commerce and retail businesses.

For sensitive personal information — which under PIPL includes biometrics, religious beliefs, health records, financial accounts, and location data of minors under 14 — the tiers tighten considerably: any export of sensitive PI of 10,000+ individuals triggers security assessment, and under 10,000 requires the standard contract or certification route. The tiering logic is set out in the Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Decree No. 16) and elaborated in the CAC expert interpretation.

One caution: you cannot split volumes to stay under a threshold. The Standard Contract Measures explicitly prohibit fragmenting transfers that should follow the security assessment route, per the Measures on the Standard Contract for Outbound Transfer of Personal Information (CAC Decree No. 13).

How Does the Standard Contract Filing Process Work?

You will typically need to complete four steps before your CRM sync goes live if you fall in the 100,000-to-1-million tier.

1. Confirm eligibility. Verify you are not a CIIO, that you process fewer than 1 million individuals' personal information in total, and that your cumulative export since January 1 of the prior year is under 100,000 individuals (or under 10,000 for sensitive PI), per the Standard Contract Measures (CAC Decree No. 13).
2. Conduct a personal information protection impact assessment (PIA). The PIA must address at least six items: legality and necessity, volume and sensitivity, the overseas recipient's protections, risks after export, remedies available to individuals, and the impact of foreign legal environments, per the same Measures.
3. Execute the standard contract. Use the model contract annexed to the Measures, which involves three parties: the exporter, the overseas recipient, and (where applicable) the individual.
4. File within 10 working days. Submit the signed contract and the PIA report to the provincial-level cyberspace administration where you are registered, per the Standard Contract Measures (CAC Decree No. 13).
5. Monitor for re-filing triggers. If the purpose, scope, data categories, sensitivity, processing method, or overseas storage location changes — or if the recipient's use changes — you must redo the PIA and re-file, per the same Measures.

Filing is a post-effectiveness obligation rather than a pre-approval, meaning the regulator reviews materials after the contract takes effect. This is confirmed in the CAC expert interpretation of the Standard Contract Measures.

When Is a Full Security Assessment Required?

You will typically need government security assessment in three situations: you are a critical information infrastructure operator (CIIO) exporting any personal information; you export important data; or you exceed 1 million individuals in non-sensitive PI exports in a calendar year. The assessment process is governed by the Measures on Security Assessment of Cross-Border Data Transfer (CAC Decree No. 11).

The timeline is structured: the CAC decides whether to accept your application within 7 working days of receipt, then completes the assessment within 45 working days of issuing the written acceptance notice, with extensions possible for complex cases. If you disagree with the result, you may request re-evaluation within 15 working days, and that outcome is final. Assessment results are valid for 3 years under the 2024 Provisions — extended from the original 2 years — and you may apply for a 3-year extension within 60 working days before expiry, per the Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Decree No. 16).

Timing matters: you should apply before the data transfer begins, and ideally before signing the cross-border legal agreement, per the Security Assessment Measures.

What Obligations Apply Regardless of Which Pathway I Use?

You will typically need to satisfy three PIPL obligations no matter which exemption or filing route applies. First, you must inform individuals that their data will be transferred overseas and specify the recipient's name, contact details, processing purpose and method, and the categories of PI involved. Second, you must obtain separate consent — a distinct, explicit consent action, not buried in a general privacy policy — per PIPL Articles 38-43. Third, you must conduct a PIA covering the export's legality, volume, and risk profile.

The 2024 Provisions reinforce this: even where a transfer is exempt from filing procedures, the obligations to notify and obtain separate consent under PIPL Article 39 remain, per the Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Decree No. 16). In practice, this means your checkout flow and CRM consent forms need a dedicated cross-border transfer disclosure — a step many brands miss when they assume exemption means no obligations at all.

What Are the Penalties for Non-Compliance?

You will typically face escalating enforcement. Provincial-level cyberspace administrations may interview operators and require rectification where filing is absent, false, or where material risks or security incidents exist, per the Standard Contract Measures (CAC Decree No. 13). For substantive violations, penalties follow the PIPL: up to RMB 1 million for refusal to correct, and for serious cases up to RMB 50 million or 5% of the prior year's revenue, plus personal fines of RMB 100,000 to 1 million on responsible individuals and potential bans from holding management roles. Criminal liability applies where a crime is constituted, per the Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Decree No. 16).

Notably, any organization or individual may report suspected illegal exports to provincial-level or higher cyberspace authorities, per the Standard Contract Measures — meaning competitors, employees, or customers can trigger scrutiny.

What to Watch Out For

1. Two different counting baselines. The Standard Contract Measures count cumulative exports "since January 1 of the prior year," while the 2024 Provisions count "since January 1 of the current year." Cite the correct provision for your pathway — do not mix the two, per the Standard Contract Measures (CAC Decree No. 13) and the Provisions (CAC Decree No. 16).
2. Remote access counts as export. A US-based account manager opening your China CRM counts as a cross-border transfer even if no data moves, per the CAC expert interpretation.
3. Exemption from filing is not exemption from consent. The contract-performance exemption waives procedural filing, not the PIPL Article 39 separate-consent requirement, per the Provisions (CAC Decree No. 16).
4. "Important data" has no universal list. Designations vary by industry and region; absent official notice, you generally need not self-designate, but monitor sector-specific catalogs, per the Provisions (CAC Decree No. 16).
5. Free trade zones may offer relief. Provincial-level negative lists, once approved and filed with the CAC and National Data Administration, exempt listed-outside data from all three pathways — relevant if you operate in Shanghai Lingang, Hainan, or similar zones, per the Provisions (CAC Decree No. 16).
6. Re-filing triggers are broad. A change in your overseas vendor, storage region, or processing purpose can require a fresh PIA and re-filing, per the Standard Contract Measures (CAC Decree No. 13).

Frequently Asked Questions

Q: Does syncing my China CRM to a US headquarters count as a data export?

A: Yes. Under the 2024 Provisions, data is deemed exported when an overseas party can access or process it, even if stored in China. A US manager logging into a China-hosted CRM triggers the same analysis as a bulk file transfer, per the Provisions (CAC Decree No. 16).

Q: My store exports order data for fewer than 100,000 customers per year. Do I need to file anything?

A: Generally no, if the data is non-sensitive personal information and you are not a CIIO. The under-100,000 tier is fully exempt from security assessment, standard contract, and certification. You still owe individuals notice and separate consent under PIPL, per the Provisions (CAC Decree No. 16).

Q: What counts as "sensitive" personal information for a CRM database?

A: Under PIPL, sensitive PI includes biometrics, religious beliefs, specific identity, medical health, financial accounts, and location tracking, plus any personal information of minors under 14. Financial account data in your CRM likely qualifies, tightening your threshold from 100,000 to 10,000 individuals, per PIPL Articles 38-43.

Q: How long does the CAC security assessment take?

A: The CAC decides acceptance within 7 working days of receiving your application, then completes the assessment within 45 working days of the written acceptance notice, extendable for complex cases. Results are valid for 3 years, per the Security Assessment Measures (CAC Decree No. 11).

Q: Can I split my exports across months to stay under the 100,000 threshold?

A: No. The Standard Contract Measures explicitly prohibit quantity-splitting to route transfers that should undergo security assessment into a lighter pathway. Volumes are counted cumulatively per calendar year, and circumvention carries enforcement risk, per the Standard Contract Measures (CAC Decree No. 13).

Q: Do I need separate consent even if my transfer is exempt?

A: Yes. Procedural exemptions under the 2024 Provisions waive filing requirements but do not waive PIPL obligations to inform individuals and obtain separate consent for cross-border transfer. Your checkout and CRM consent flows must include a dedicated disclosure, per the Provisions (CAC Decree No. 16).

Q: What is a PIA and when must I do one?

A: A personal information protection impact assessment documents the legality, necessity, volume, sensitivity, recipient safeguards, and post-export risks of your transfer. It is mandatory before any export regardless of pathway, and must be redone when purpose, scope, categories, sensitivity, method, or storage location change, per the Standard Contract Measures (CAC Decree No. 13).

Q: I operate in a Shanghai free trade zone. Does that change anything?

A: Possibly. Free trade zones may adopt negative lists — approved by the provincial cyberspace commission and filed with the CAC and National Data Administration — and data outside those lists is exempt from all three pathways. Check whether your data category is listed, per the Provisions (CAC Decree No. 16).

Q: What happens if I file the standard contract late or not at all?

A: Provincial cyberspace authorities may interview you and require rectification where transfers pose significant risks or a security incident occurs. Substantive violations escalate to PIPL penalties — up to RMB 50 million or 5% of prior-year revenue in serious cases — per the Standard Contract Measures (CAC Decree No. 13) and PIPL.

Q: How do I figure out which pathway applies to my specific CRM and order flows?

A: Start by inventorying data categories, volumes, and destinations, then map each flow against the three tiers and six exemptions. CnBusinessHub can help you evaluate your options and coordinate with qualified local counsel to prepare the PIA, standard contract, or assessment application, per the framework in the Provisions (CAC Decree No. 16).

Conclusion

1. Map before you move. Inventory every order and CRM data flow — including remote access — and classify each as exempt, standard contract, or security assessment tier before syncing anything overseas.
2. Respect the 100,000 / 1,000,000 thresholds. They determine your filing burden, and volume-splitting is explicitly prohibited.
3. Exemption does not mean no obligations. Notice and separate consent under PIPL apply to every cross-border transfer, regardless of pathway.
4. Budget realistic timelines. Standard contract filing takes 10 working days post-signature; security assessments run 7 plus 45 working days with 3-year validity.

For personalized guidance on your China e-commerce licensing pathway, contact the CnBusinessHub advisory team at consult@CnBusinessHub.com to book a consultation.

Written by the CnBusinessHub Advisory Team, China market-entry advisors since 2019 — 1,500+ foreign enterprises guided across 16+ cities.

Last updated: 2026-10-11 | Next review: April 2027

Sources

1. Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Decree No. 16)
2. CAC Expert Interpretation: Important Provisions on Promoting and Regulating Cross-Border Data Flows
3. CAC Expert Interpretation: New Provisions Lead New Trends in Cross-Border Data Flows
4. Measures on Security Assessment of Cross-Border Data Transfer (CAC Decree No. 11)
5. Measures on the Standard Contract for Outbound Transfer of Personal Information (CAC Decree No. 13)
6. CAC Expert Interpretation: Standard Contract Improves China's Outbound Personal Information Management System
7. Personal Information Protection Law of the PRC, Articles 38-43
8. CAC Announcement of the Provisions on Promoting and Regulating Cross-Border Data Flows

Related Reading

• Cross-Border Data Transfer Compliance China: Exporter Guide for 2026
• PIPL Compliance Guide for Foreign Companies in China 2026
• PIPL Compliance for WFOEs 2026 — Data Privacy Requirements for Foreign Companies