【中英文对照版】促进和规范数据跨境流动规定.docx

（第16号）促进和规范数据跨境流动规定已经2023年11月28日国家互联网信息办公室2023年第26次室务会议审议通过，现予公布，自公布之日起施行。国家互联网信息办公室主任庄荣文2024年3月22日促进和规范数据跨境流动规定第一条为了保障数据安促进和规范数据跨境流动规定ProvisionsonPromotingandRegulatingCross-borderDataFlow制定机关：国家互联网信息办公室发文字号：国家互联网信息办公室令第16号公布日期：2024.03.22施行日期：2024.03.22效力位阶：部门规章法规类别：网络安全管理IssuingAuthority:CyberspaceAdministrationofChinaDocumentNumber：OrderNo.16oftheCyberspaceAdministrationofChinaDateIssued：03-22-2024EffectiveDate：03-22-20241.evelofAuthority：DepartmentalRulesAreaof1.aw：NetworkSecurityManagement国家互联网信息办公室令OrderoftheCyberspaceAdministrationofChina(No.16)TheProvisionsonPromotingandRegulatingCross-borderDataFlow,asdeliberatedandadoptedatthe26thexecutivemeetingoftheCyberspaceAdministrationofChinain2023onNovember28,2023,areherebyissuedandshallcomeintoforceonthedateofissuance.ZhuangRongwenjDirectoroftheCyberspaceAdministrationofChinaMarch22,2024ProvisionsonPromotingandRegulatingCross-borderDataFlowArticle1Forthepurposesofensuringnationaldatasecurity,protectingtherightsandinterestsofpersonalinformation,andpromotingthefreeandorderlyflowofdatainaccordancewiththelaw,theseProvisionsaredeveloped,inaccordancewiththeCybersecurity1.awofthePeople'sRepublicofChina,theDataSecurity1.awofthePeople'sRepublicofChina,thePersonalInformationProtection1.awofthePeople'sRepublicofChina,andotherapplicablelawsandregulations,fortheimplementationoftherulesforthesecurityassessmentofoutbounddatatransfer,thestandardcontractfortheoutboundtransferofpersonalinformation,personalinformationprotectioncertification,andotherrulesforoutbounddatatransfer.Article2Adataprocessorshallidentifyandreportimportantdatainaccordancewiththeapplicableprovisions.Adataprocessorisnotrequiredtoapplyforasecurityassessmentofoutbounddatatransferfordatatreatedasimportantdataiftherelevantauthorityorregiondoesnotnotifythedataprocessorthatthedataistreatedasimportantdataordoesnotpubliclyreleasethedataasimportantdata.全，保护个人信息权益，促进数据依法有序自由流动，根据中华人民共和国网络安全法、中华人民共和国数据安全法、中华人民共和国个人信息保护法等法律法规，对于数据出境安全评估、个人信息出境标准合同、个人信息保护认证等数据出境制度的施行，制定本规定。第二条数据处理者应当按照相关规定识别、申报重要数据。未被相关部门、地区告知或者公开发布为重要数据的，数据处理者不需要作为重要数据申报数据出境安全评估。第三条国际贸易、跨境运输、学术合作、跨国生产制造和市场营销等活动中收集和产生的数据向境外提供，不包含个人信息或者重要数据的，免予申报数据出境安全评估、订立个人信息出境标准合同、通过个人信息保护认证。Article3Wherethedatacollectedandgeneratedinthecourseofinternationaltrade,cross-bordertransportation,academiccooperation,multinationalproduction,manufacturingandmarketing,andotheractivitiesisprovidedtoanoverseasrecipientanddoesnotcontainanypersonalinformationorimportantdata,adataprocessorshallbeexemptfromapplyingforasecurityassessmentofoutbounddatatransfer,concludingastandardcontractfortheoutboundtransferofpersonalinformation,orpassingapersonalinformationprotectioncertification.Article4WhereadataprocessortransmitsanypersonalinformationcollectedandgeneratedoutsideChinaforprocessinginChinaandthenprovidesittoanoverseasrecipient,anddoesnotintroduceanypersonalinformationorimportantdatageneratedinChinaduringtheprocessing,thedataprocessorshallbeexemptfromapplyingforasecurityassessmentofoutbounddatatransfer,concludingastandardcontractfortheoutboundtransferofpersonalinformation,orpassingapersonalinformationprotectioncertification.Article5Underanyofthefollowingcircumstances,adataprocessorthatprovidespersonalinformationtoanoverseasrecipientshallbeexemptfromapplyingforasecurityassessmentofoutbounddatatransfer,concludingastandardcontractfortheoutboundtransferofpersonalinformation,orpassingapersonalinformationprotectioncertification:(1) Anypersonalinformationmustbeprovidedtoanoverseasrecipientasneededfortheconclusionorperformanceofacontracttowhichtheindividualisacontractingparty,suchascross-bordershopping,delivery,remittance,payment,andaccountopening,bookingofairticketsandhotels,visaapplication,andexamservices.(2) Thepersonalinformationofanyinternalemployeemustbeprovidedtoanoverseasrecipientasneededforhumanresourcemanagementunderthelaborrulesandregulationsdevelopedinaccordancewiththelawandacollectivecontractsignedinaccordancewiththelaw.第四条数据处理者在境外收集和产生的个人信息传输至境内处理后向境外提供，处理过程中没有引入境内个人信息或者重要数据的，免予申报数据出境安全评估、订立个人信息出境标准合同、通过个人信息保护认证。第五条数据处理者向境外提供个人信息，符合下列条件之一的，免予申报数据出境安全评估、订立个人信息出境标准合同、通过个人信息保护认证：（一）为订立、履行个人作为一方当事人的合同，如跨境购物、跨境寄递、跨境汇款、跨境支付、跨境开户、机票酒店预订、签证办理、考试服务等，确需向境外提供个人信息的；（二）按照依法制定的劳动规章制度和依法签订的集体合同实施跨境人力资源管理，确需向境外提供员工个人信息的；（三）紧急情况下为保护自然人(3) Anypersonalinformationmustbeprovidedtoanoverseasrecipienttoprotectthelife,health,orpropertysafetyofnaturalpersonsunderemergencycircumstances.(4) Itisadataprocessor,otherthanacriticalinformationinfrastructureoperator,thathascumulativelyprovidedthepersonalinformation(excludingsensitivepersonalinformation)oflessthan100,000individualstoanoverseasrecipientasofJanuary1ofthecurrentyear.Forthepurposeoftheprecedingparagraph,“personalinformationprovidedtoanoverseasrecipient"doesnotincludeimportantdata.Article6Undertheframeworkofnationalclassifiedandgradeddataprotectionsystems,apilotfreetradezonemaydevelopalistofdatathatneedstobeincludedinthescopeofthesecurityassessme