Personal Information Outbound Certification Measures effective 1 Jan 2026

China Government Network hosts Order No. 20 of CAC and the State Administration for Market Regulation: the 个人信息出境认证办法 (Personal Information Outbound Certification Measures). The order is dated 14 October 2025 and Article 19 states the measures take effect on 1 January 2026. The full text was opened on 20 September 2026.

Who may use certification (Article 5)

A personal-information processor may use certification to provide personal information overseas only if all of the following hold:

1. It is not a critical information infrastructure operator.
2. From 1 January of the year, cumulative outbound personal information is more than 100,000 and fewer than 1 million individuals (excluding sensitive PI), or fewer than 10,000 individuals’ sensitive personal information.
3. The outbound set does not include important data.

Processors must not split volumes to dodge a security assessment. Before applying, Article 6 requires notice, separate consent where required, and a personal-information protection impact assessment covering purpose/necessity, scale/sensitivity, overseas recipient safeguards, and destination-country law risk.

Certification mechanics

Articles 7–10: apply to a qualified professional certification body; certificates last three years (re-apply from six months before expiry); bodies must report certificate status to the national certification information platform within five working days; certificates can be suspended or revoked if outbound activity no longer matches the certified scope.

What this is not

Certification is one PIPL Article 38 outbound path alongside security assessment and standard contracts. This order does not abolish those paths, does not authorise CII outbound via certification, and does not mean every MMP export of China player data is already certified. “Fully operational from 1 Jan 2026” in the commission title maps to this effective date; the order itself was published in October 2025.

Operator action

Download the certification card. Prefer this gov.cn text over secondary legal blogs when updating China data-transfer runbooks.

Research checked 20 September 2026. Local draft; human editorial review pending.