CBDT roadmap · Path tree · Employee data · PIPL vs GDPR · Data flagship.
An SCC is a filing with provincial cyberspace administration, not a licence and not a substitute for picking the right path. First confirm you should not be in a security assessment (CII, important data, or current volume rules — read the CAC text in force). Then: impact assessment → official Chinese SCC template → file. Expect weeks to a couple of months of prep and supplements, not a one-hour upload. Cost is internal time plus counsel, not a public auction fee. European GDPR SCCs do not replace China SCCs. HR-only: finish the employee-data map first.
At a glance
| Question | Short answer |
|---|---|
| Is SCC an approval? | No — a filing, after you confirm you are not in assessment. |
| How long? | Prep often weeks–~2 months. Not an SLA. |
| Cost? | Time + counsel. No sticker price here. |
| EU SCC enough? | No. |
| HRIS only? | Employee-data page, then this filing. |
Scope and legal framework
PIPL outbound + CAC SCC measures. The standard contract is one of three families. You still need a personal-information protection impact assessment and the official template. Filing is with the local/provincial CAC as the measures provide.
When assessment is more likely. Critical-information-infrastructure, important data, or volume/role tests in the current outbound rules. Do not memorise a 2022 headcount.
Practical workflow
- Re-read the roadmap so you are not in assessment by mistake.
- Finish the PIA and the official SCC (Chinese).
- File with the competent cyberspace administration; answer supplements.
- Operate with change control — a new vendor reopens the story.
Common mistakes
- Uploading an English GDPR annex and calling it China SCC.
- Filing while important data is in the same pipe.
- No owner for the next system go-live.
Action checklist
- Path memo: why not assessment.
- Official template executed.
- PIA signed.
- Provincial filing pack complete.
- Change-control owner named.
Find China data counsel
The data-privacy listings below are live DJ Classifieds profiles. Directory →
Attribution
Reviewed by Tongyu Yan, Shanghai (cross-border data transfer counsel). Advises on cross-border personal information transfer compliance, including mechanism selection and filing-oriented programmes under PIPL-era rules. View directory profile →
Review tier: Reviewed by — accuracy review of drafts for orientation only. Content remains general information — not legal advice for a specific matter, and no attorney–client relationship is created by reading these pages.
How to use this guide
This page is general information for orientation. It is not legal advice and does not create an attorney–client relationship. For methodology and AI-assisted drafting rules, see our Editorial Policy and AI Content Policy. Directory badge meaning is described in the Lawyer Verification Policy.
Prefer primary statutes, judicial interpretations, and official guidance when making decisions. Where this guide links to city hubs or lawyer listings, verify credentials and engagement terms directly with counsel. Full disclaimer · Request a consultation.
Common questions
Quick answers for foreign nationals and employers. Rules vary by city and change over time.
How much does SCC filing cost?
There is no useful public sticker. Budget legal drafting, internal mapping time, and possible supplements — not a marketplace fee.
Can we use GDPR SCCs instead?
No. They may sit in the same folder. They do not satisfy the China filing.
Verified Data Privacy & Cybersecurity lawyers
China-based listings shown first. Browse lawyer profiles for data privacy & cybersecurity, then request legal help.
-
Joyce Huang
Joyce Huang is a partner at Jiushang Law Firm (Beijing & Shenzhen) focusing on capital markets data compliance, M&A and investment data d...
-
Peizheng Zhou
Peizheng Zhou is a cybersecurity and data security lawyer in Shenzhen, advising foreign and domestic clients on regulatory compliance and...
-
Wen Lei
Wen Lei is a cybersecurity incident response lawyer in Beijing Haidian, advising foreign and domestic clients on regulatory compliance an...
-
Ruiqing Long
Ruiqing Long is a personal information protection (pipl) lawyer in Beijing Chaoyang, advising foreign and domestic clients on regulatory ...
-
Tongyu Yan
Tongyu Yan is a cross-border data transfer lawyer in Shanghai Pudong, advising foreign and domestic clients on regulatory compliance and ...
Need counsel on data privacy & cybersecurity?
Connect with listed lawyers to request legal help. No obligation.