China Personal Information Protection Law (PIPL) 40: Art. 40 Domestic storage for critical information infrastructure operators and processors above the CAC threshold; security assessment before provision abroad

What does 40 require?

Critical information infrastructure operators and processors that process personal information up to the amount the CAC prescribes must store within China the personal information collected and generated in China, and where provision abroad is truly necessary must pass the CAC's security assessment, unless a law, administrative regulation or CAC provision says assessment is unnecessary; under the 2024 provisions the assessment applies to important data, any transfer by a CIIO, and personal information of one million or more individuals or sensitive information of 10,000 or more since 1 January of the year.