Data flagship · Employee data · Path tree · SCC filing · PIPL vs GDPR.
Map the flow, assess impact, then pick a live CAC family: standard contract, certification, or security assessment. Tick-box consent is not a pathway. “HQ view only” is still a transfer if the admin sits abroad. Thresholds, important-data catalogues and free-trade-zone carve-outs change — use the instruments in force the week you file, not a 2022 webinar’s headcount. This page sequences the project. HR rosters: employee-data page. SCC paperwork: SCC timeline.
At a glance
| Question | Short answer |
|---|---|
| Is SaaS abroad a transfer? | Usually yes if PI leaves or is accessible from abroad. |
| Consent enough? | No. |
| Which path? | SCC / certification / assessment — confirm live rules. |
| HR only? | Use the employee-data spoke after the map. |
| Deadlines? | Project bands, not an SLA. |
Scope and legal framework
PIPL outbound chapter. Providing personal information abroad is a regulated act. Separate consent may still be required and still does not replace a transfer mechanism.
CAC outbound measures (assessment / SCC / certification). Three families. Which one you need depends on role (CII), important data, volume and the current implementing rules. Quote the gazette, not a memorised number.
Practical workflow
- Inventory systems, vendors and who can see China PI from abroad.
- Tier PI / sensitive PI / important data — do not guess “important.”
- Choose the live pathway family.
- PIA / PIPIA, contracts, then file or assess.
- Change control when you add a vendor or a new HQ report.
Common mistakes
- Using last year’s headcount trigger as current law.
- Letting GDPR SCC stand in for China SCC.
- Mapping customers but forgetting employee and vendor-admin access.
Action checklist
- System list + data types.
- Current CAC text on the desk.
- Path chosen in writing.
- HR split to the employee-data page if needed.
- Owner for change control.
Find China data counsel
The data-privacy listings below are live DJ Classifieds profiles. Directory →
