APAC / Asia-Pacific / revised 28 Oct 2026
China PIPL Articles 38 to 40: Cross-Border AI Data Transfers
Sending a prompt containing personal information collected in mainland China to a model hosted abroad is a cross-border provision under the PIPL. It needs a lawful mechanism, separate consent, and an impact assessment, and above certain volumes a CAC security assessment. The March 2024 provisions narrowed the regime with exemptions and higher thresholds, which changes the calculation for many AI features.
- Citation
- Personal Information Protection Law of the PRC, Articles 38 to 40 and 55; CAC Provisions on Promoting and Regulating Cross-Border Data Flows (22 March 2024)
- Regulator
- Cyberspace Administration of China (CAC) and its provincial offices
- In force
- 1 November 2021 (PIPL); 22 March 2024 (cross-border data flow provisions)
- Maximum penalty
- For serious violations, up to RMB 50 million or 5% of the previous year's turnover, plus fines of RMB 100,000 to 1 million for directly responsible persons (Art. 66)
Articles 38 and 39: mechanism and separate consent
Article 38 lets a personal information handler provide personal information outside China only when it meets one of the listed conditions: passing a CAC security assessment, obtaining personal information protection certification from a professional institution, concluding the CAC standard contract with the overseas recipient, or another condition set by law or the CAC. Article 39 requires the handler to inform individuals of the recipient's name and contact details, the purposes and methods of processing, the categories of data, and how to exercise their rights, and to obtain separate consent where consent is the legal basis. Article 55 requires a personal information protection impact assessment before any cross-border provision.
Article 40: localisation for CIIOs and volume handlers
Critical information infrastructure operators, and handlers processing personal information above volumes set by the CAC, must store personal information collected and generated in China within China. If they need to provide it abroad, they must pass a CAC security assessment.
The March 2024 provisions
The CAC's Provisions on Promoting and Regulating Cross-Border Data Flows took effect on 22 March 2024. They exempt several scenarios from any mechanism, including transfers necessary to perform a contract with the individual (such as cross-border purchases, shipping, payment and travel bookings), cross-border HR management under lawful labour rules, emergencies protecting life and property, and handlers other than CIIOs that have provided personal information of fewer than 100,000 individuals abroad since 1 January of the current year.
- Security assessment: non-CIIO handlers providing non-sensitive personal information of more than 1 million individuals, or sensitive personal information of more than 10,000 individuals, since 1 January of the year
- Standard contract or certification: more than 100,000 but fewer than 1 million individuals' non-sensitive personal information, or fewer than 10,000 individuals' sensitive personal information
- Important data: no assessment is needed unless the data has been notified or publicly announced as important data by the relevant authorities
- Free trade zones may publish negative lists; data outside the list may be transferred without a mechanism
- 01
Count individuals, not requests
Thresholds run on the number of individuals whose data is provided abroad since 1 January. Key the counter on a stable pseudonymous subject identifier so retries and long conversations do not inflate the count, and alert well before 100,000. - 02
Separate consent capture
Article 39 consent must be specific to the cross-border provision. Store a consent reference with each user and have the gateway check it before an offshore route; without it, route domestically or refuse. - 03
Domestic inference path
Mainland cloud regions are operated by local partners under separate account systems. Keep a domestic model path ready so that sensitive personal information and CIIO traffic never needs to leave. - 04
Mask resident identity card numbers
The 18-character resident identity card number has a fixed structure with a check character. Detect and tokenise it in-path; identity numbers are commonly treated as sensitive personal information under the Article 28 test, since their leakage can harm personal and property safety. - 05
Keep the PIPIA tied to the route
Record the impact assessment reference in the policy pack so that every offshore route can be traced to the assessment that justified it. Article 56 requires PIPIA reports to be kept for at least three years.
| # | Rule | Legal rationale |
|---|---|---|
| 01 | Sensitive personal information from mainland China resolves to domestic endpoints only, unless the tenant has recorded a standard contract or certification covering it. | Sensitive data carries the lowest thresholds, and even small volumes need a mechanism. |
| 02 | Traffic from tenants flagged as CIIOs never leaves mainland China. | Article 40 requires domestic storage and a security assessment for any outbound provision. |
| 03 | Offshore routes require a separate-consent reference for the data subject. | Article 39 consent is a precondition the gateway can check mechanically. |
| 04 | Freeze offshore routing automatically when the annual individual count reaches the tenant's mechanism ceiling. | Crossing 100,000 or 1 million individuals changes the required mechanism; continuing to send data while the filing catches up is a violation. |
cn-pipl-outbound
The rules above, written as Open Policy Agent Rego (v1 syntax). The gateway evaluates the pack in-process in every regional data plane before forwarding a request; YTT Secunet measures median evaluation under 3 ms in production.
Packs are versioned and signed. The version that decided each request is named in the residency receipt, so an auditor can match the decision to this exact text.
How the policy engine workspackage yttsecunet.policies.cn_pipl_outbound
import rego.v1
default allow := false
cn_regions := {"cn-north-1", "cn-northwest-1", "chinanorth3"}
allow if {
input.route.provider_region in cn_regions
}
allow if {
not input.route.provider_region in cn_regions
not input.tenant.ciio
not input.request.sensitive_pi
input.subject.separate_consent_ref != ""
input.tenant.individuals_ytd < input.tenant.mechanism_ceiling
}
reasons contains "CIIO data must stay in mainland China" if {
input.tenant.ciio
not input.route.provider_region in cn_regions
}Each item is verifiable against configuration, signed receipts or contract records. Tick through it with your DPO.
Is a prompt sent to an offshore model really a cross-border provision?
Yes, if it contains personal information collected in China and is processed by a recipient abroad. Transient processing does not change the analysis; the recipient still accesses the data.
Can we rely on the contract exemption for a customer support chatbot?
Only where the transfer is genuinely necessary to perform a contract with the individual, such as a cross-border order. General support or analytics use cases are harder to fit and need a mechanism.
Does YTT Secunet operate a data plane in mainland China?
No. For mainland data, customers run Sovereign Dedicated inside their own mainland environment, where the policy engine and proof ledger run locally against domestic model endpoints.
Sovereign route ready
Stop risking 4% global turnover GDPR fines on AI inference.
Deploy sovereign, cryptographically proven AI routing in 15 minutes.