Transferring data out of China is not a crime by itself, but moving personal information abroad without meeting the conditions in China’s Personal Information Protection Law (PIPL) can trigger heavy administrative fines — and, in serious cases, criminal liability under Article 253-1 of the Criminal Law.

What rules apply when you send data out of China?

Article 38 of the PIPL says a company that needs to provide personal information to a recipient outside China must satisfy one of four routes: a security assessment organised by the Cyberspace Administration of China (CAC); certification by a professional body; a standard contract with the overseas recipient; or another condition set by law. Article 39 adds that you must tell the individual the recipient’s identity, the purpose, the categories of data and how to exercise their rights abroad — and obtain their separate consent. For critical information infrastructure operators and processors that reach the CAC’s data-volume threshold, Article 40 requires personal information collected in China to be stored in China, with a security assessment before any export. Article 41 matters in disputes: without approval from a Chinese authority, you cannot hand over personal information stored in China to a foreign court or law-enforcement agency.

When does a data transfer become a crime?

Administrative penalties come first. Under Article 66 of the PIPL, an unlawful transfer can bring a warning, confiscation of gains and fines up to RMB 1 million; where the circumstances are serious, fines can reach RMB 50 million or 5% of the previous year’s turnover, plus personal fines of RMB 100,000 to 1,000,000 and a ban on holding senior roles. Criminal liability attaches through Article 253-1 of the Criminal Law, which punishes anyone who, in violation of state regulations, sells or provides citizens’ personal information: up to three years’ imprisonment where the circumstances are serious, and three to seven years where they are especially serious. A company can be fined as a unit, and its managers held personally responsible.

What this means in practice

Data-heavy businesses are the most exposed: finance, healthcare, e-commerce and any foreign employer handling Chinese HR records. In 2024 the CAC issued rules exempting some low-risk, small-volume transfers from the heaviest requirements, but large-scale or sensitive data still needs the full process. The practical habit is simple: map what leaves China, keep a lawful transfer route in place, and collect separate consent before anything is exported.

A scenario

(Hypothetical.) A foreign-invested manufacturer sends its Chinese employees’ HR files — ID numbers, salary data, health records — to its regional headquarters each month without a standard contract or assessment. If the data is later leaked or sold, prosecutors can treat it as a criminal case under Article 253-1.

In short: cross-border data transfer is a compliance problem first and a criminal one only when the breach is serious — but that line is easier to cross than most companies expect.

Frequently asked questions

Q: What rules apply when you send data out of China?

A: Article 38 of the PIPL says a company that needs to provide personal information to a recipient outside China must satisfy one of four routes: a security assessment organised by the Cyberspace Administration of China (CAC); certification by a professional body; a standard contract with the overseas recipient; or another condition set by law.

Q: When does a data transfer become a crime?

A: Administrative penalties come first. Under Article 66 of the PIPL, an unlawful transfer can bring a warning, confiscation of gains and fines up to RMB 1 million; where the circumstances are serious, fines can reach RMB 50 million or 5% of the previous year’s turnover, plus personal fines of RMB 100,000 to 1,000,000 and a ban on holding senior roles.

Wang Guan | Co-founder, Beijing Haolue Law Firm | +86 17813108512