CBDT roadmap · SCC filing · Employee data · PIPL vs GDPR · Data flagship.
Security assessment if you hit the current CAC triggers — CII, important data, or the live volume/role test (do not memorise a 2022 headcount). China SCC filing is the usual path for many ordinary B2B and HR exports once assessment is off the table — see the filing page. Certification is a narrower recognised-body route. Exemptions and FTZ lists exist and move; they are not “we are a WFOE so we skip CAC.” GDPR SCCs still do not count. HR-only: finish the employee-data map first.
At a glance
| Question | Short answer |
|---|---|
| When assessment? | CII, important data, or live volume/role test. |
| Default B2B? | Often China SCC — after you rule out assessment. |
| GDPR SCC? | Does not satisfy CAC. |
| WFOE = exempt? | No. |
| HR only? | Employee-data page, then this fork. |
Scope and legal framework
PIPL outbound + CAC measures. Three mechanism families: security assessment, standard contract, and certification. Separate notices describe when assessment is mandatory and when other paths (including listed exemptions) may apply.
Triggers that move. Important-data catalogues, CII status, and volume/role thresholds are versioned. Read the CAC text in force — not a 2022 slide.
What this page is not. How to file an SCC (sister). How PIPL differs from GDPR (sister). The full data map (roadmap).
Practical workflow
- Inventory systems, volume, important-data flags, CII.
- Path memo: why not assessment (or why yes).
- If SCC: filing page. If assessment: CAC process, not a provincial SCC upload.
Common mistakes
- Using last year’s headcount as the law.
- Calling an FTZ rumour a group-wide exemption.
- Uploading GDPR SCCs and stopping.
Action checklist
- Trigger table dated with the CAC notice you used.
- Path labelled.
- Owner for the matching filing.
Find China data counsel
The data listings below are live DJ Classifieds profiles. Directory →
