China Personal Information Protection Law (PIPL) 38: Art. 38 Cross-border provision only through one of the four mechanisms, with the overseas recipient held to the Law's standard

What does 38 require?

A processor that truly needs to provide personal information to a party outside China for business or other reasons must pass the CAC's security assessment under Article 40, obtain personal information protection certification from a specialised institution under CAC provisions, conclude a contract with the overseas recipient on the CAC's standard contract, or meet other conditions set by law, administrative regulation or the CAC; conditions in an international treaty or agreement China has concluded may be followed; and the processor must take necessary measures to ensure the overseas recipient's processing meets the protection standard the Law sets. The 2024 provisions set the volume thresholds that select the mechanism and the exemptions below them.