Two Departments Jointly Issue Measures for Certification of Cross-Border Provision of Personal Information

On October 14, 2025, the Cyberspace Administration of China and the State Administration for Market Regulation jointly promulgated the Measures for Certification of Cross-Border Provision of Personal Information (the “Measures”), which will take effect on January 1, 2026.

The Measures apply to Non-Critical Information Infrastructure Operators that, on an annual basis, provide abroad personal information of 100,000 or more but fewer than 1 million individuals (excluding sensitive personal information), or sensitive personal information of fewer than 10,000 individuals, provided that Important Data is not involved. Personal Information Processors must apply to a Professional Certification Institution for certification, with certificates valid for three years. Professional Certification Institutions are required to submit certification information; upon discovering non-conformity, they shall suspend or revoke certificates. Certification Institutions must file with the cyberspace authority within 10 days. The Cyberspace Administration of China and the State Administration for Market Regulation shall supervise certification activities.