检索整个资料库

搜索法律、法规、标准与实务指南

猜你想搜

当前重点

2026-07-03互联网信息服务管理办法修订草案公开征求意见2026-06-18网络数据安全风险评估:草案与最终办法

What changed

重要变化概览

比较认证适用范围、门槛、有效期、续期与监督机制的制度演进。

  • The 2025 measures expressly define who may use export certification and exclude important data.
  • The newer measures add dedicated obligations for processors, overseas recipients, certification bodies, and oversight authorities.
  • The existing three-year certificate term and six-month renewal window remain part of the certification framework rather than being newly created in 2025.
modified

Legal instrument

此前规则

A 2022 joint announcement and implementation rules established the personal-information protection certification process.

当前规则

CAC and SAMR Order No. 20 creates dedicated departmental measures for personal information export certification.

实际影响:The export route now has a dedicated regulatory instrument in addition to certification rules and standards.

The instruments have related but different functions.

added

Route eligibility

此前规则

The 2022 rules covered personal-information processing certification generally and added requirements for cross-border processing.

当前规则

The 2025 measures specify non-CIIO eligibility and the 100,000 to below 1 million ordinary-PI or below 10,000 sensitive-PI ranges, subject to other rules.

实际影响:Creates a clearer route-selection condition for export certification.

2025 Measures Article 5; important data is excluded and splitting to evade assessment is prohibited.

clarified

Certificate lifecycle

此前规则

The 2022 rules set a three-year validity period and application within six months before expiry for continued use.

当前规则

The certification framework continues to use lifecycle, supervision, change, suspension, and withdrawal controls under the applicable certification rules.

实际影响:Do not describe the three-year term or six-month renewal timing as first introduced in 2025.

2022 implementation rules section 5.1; read with current certification rules.

added

Processor and recipient duties

此前规则

The 2022 framework required compliance with GB/T 35273 and the then-current cross-border certification specification.

当前规则

The 2025 measures expressly address processor and overseas-recipient responsibilities, legal agreements, impact assessment, rights, incidents, and supervision.

实际影响:Operational certification preparation must cover both route eligibility and substantive cross-border safeguards.

Use the full 2025 official text and current standards for implementation.

procedural

Conflict rule

此前规则

Earlier certification materials operated before the dedicated export-certification measures.

当前规则

The 2025 measures state that inconsistent earlier provisions are superseded by the measures.

实际影响:Current route analysis should prioritize the 2025 measures where earlier provisions conflict.

2025 Measures Article 18.

官方来源