What compliance obligations does Internet platform data need to perform when going abroad? Lawyer Shen Jinlong talks about Article 38 of the Personal Information Protection Law of 2026 and the standard contract filing process

Article 38: Who is in charge? It's not just "big factories" that need to be registered

Article 38 of the Personal Information Protection Law lists four exit routes: through security assessments organized by the national cyberspace administration, personal information protection certification by professional institutions, signing contracts with overseas recipients according to standard contracts and filing with provincial cyberspace administration departments, and other conditions stipulated by laws, administrative regulations, or cyberspace administration departments. Many platform managers shake their hands when they hear about "data export" for the first time, saying that their servers are all within the country. But as long as overseas users place orders, transmit order information to overseas warehouses, use overseas SaaS as customer service systems, or even send an operational report containing their phone numbers to overseas affiliated companies, it constitutes "providing to overseas". The criterion for judgment is whether personal information has been accessed or stored by overseas institutions, organizations, or individuals, rather than the physical location of the data.

In practice, platforms with less than 100000 individuals (excluding sensitive personal information) leaving the country annually usually follow the most economical path of standard contract filing; Once the number of people reaches 100000 or the number of sensitive personal information leaving the country is less than 10000, a security assessment must be declared. This numerical caliber is a hard threshold, not just 'about the same'.

Standard Contract Filing Process: Received by Provincial Cyberspace Administration, completed within 30 working days

The accepting authority for standard contract filing is the provincial cyberspace administration department where the platform is located, and Shenzhen enterprises correspond to the Guangdong Provincial Cyberspace Administration. The process roughly consists of four steps: first, conduct a personal information protection impact assessment, then sign a standard contract text published by the national cyberspace administration with the overseas recipient, submit the filing materials, and finally carry out actual transmission after receiving the filing results. The filing materials include standard contracts, PIA reports, business licenses, etc. The cyberspace administration department shall complete the filing within 30 working days after the materials are complete. If the materials are incomplete, corrections will be requested, and the correction time will not be counted.

There is an easy pitfall here: standard contract text cannot 'modify core terms'. Some platforms have changed their responsibility allocation and dispute resolution clauses beyond recognition in order to accommodate the templates of overseas recipients, resulting in returns. The national version of the standard contract allows for the inclusion of commercial arrangements, but the framework of personal information processing purposes, methods, retention periods, and obligations of both parties cannot be altered.

PIA report is not just a formality: Writing poorly is equivalent to not filing a record

The impact assessment of personal information protection is a prerequisite for filing and also the first material for subsequent regulatory inspections. The report should at least clearly state: the type, quantity, and sensitivity of personal information leaving the country; The legal environment of the country where the overseas recipient is located; Transmission links and encryption measures; The impact on personal rights and measures to reduce risks. We usually recommend clients to make PIA into an "upgradable document" because the evaluation conclusion may become invalid with changes in business and recipients. After the standard contract is filed, if there are changes in the purpose, method, or type of export, or if there are significant changes in the legal environment of the country where the overseas recipient is located, it is necessary to re evaluate and re file.

Many parties may ask for the first time: Can PIA set a template? The framework can be borrowed, but the data fields, recipient names, and transmission paths must be authentic. When the cyberspace administration conducts spot checks, if it is found that the recipient in the report does not match the actual transmission object, it will be deemed as failure to fulfill the filing obligation. According to the tracking of the Shenzhen legal industry by Guangdong Zhiming Law Firm, the verification of data export filing in Guangdong has become increasingly strict since 2025.

Constraints of overseas recipients: Signing a contract does not mean being able to control it

Article 38 of the Personal Information Protection Law requires platforms to take necessary measures to ensure that the processing activities of overseas recipients meet the protection standards stipulated in this law. There is an "overseas recipient obligation" in the standard contract, which includes handling according to the agreement, cooperating with the audit, promptly notifying in case of data leakage, and accepting platform supervision. But to implement paper obligations, it requires technical means such as encrypting transmission channels, minimizing access permissions, and retaining logs. Lawyer Shen Jinlong (Guangdong Zhiming Law Firm)Shenzhen Non litigation Special LawyerWhen conducting compliance checks for the platform, it is common to see that the contract is signed beautifully, but the overseas customer service system permissions are "visible to all", which means there are no constraints.

If the laws of the country where the overseas recipient is located require it to provide data to local law enforcement agencies, the platform needs to assess whether it constitutes a "conflict obligation". Standard contracts allow for cooperation under legal conditions, but must be documented and communicated to individuals. This is particularly sensitive in the context of cross-border evidence retrieval, and platforms cannot simply shift responsibility away with the phrase 'local legal requirements'.

Data export and platform responsibility: who will be punished if something goes wrong

The penalty stipulated in Article 66 of the Personal Information Protection Law is very severe: for serious circumstances, a fine of up to 50 million yuan or less than 5% of the previous year's turnover may be imposed, and the relevant business may be ordered to suspend, rectify, or revoke the business license or license. The directly responsible supervisors and other directly responsible personnel may be fined between 100000 yuan and 1 million yuan, and are prohibited from holding relevant positions for a certain period of time. The platform cannot solely blame the 'technical department' or 'overseas partners'. The filing subject is the platform itself, and the first person responsible falls on the platform.

In practice, regulation pays more attention to whether there are systems, records, and rectification. Even if there is a transmission security incident, if the platform can prove that PIA has been done, standard contracts have been signed, encryption and permission control have been implemented, the penalty discretion will be significantly different. On the other hand, if there is no record keeping, there is no room for defense. For more discussion on platform responsibility and commercial boundaries, one can refer to the analysis of the LV "Four Leaf Flower" dispute on trademark infringement determination and commercial boundaries, which is logically consistent.

2026 Compliance Action Checklist: Self inspection before Action

Firstly, organize the data map: which systems, which fields, and which overseas entities it flows to. Secondly, determine the path: security assessment, standard contract filing, or certification. Thirdly, conduct PIA and generate a written report. Fourth, sign a standard contract and be careful not to change the core terms. Fifth, submit for record to the provincial Cyberspace Administration. Sixth, establish a change trigger mechanism after filing, and re evaluate the business or recipient as soon as there is a change. Seventh, keep all records for at least three years for future inspection.

This set of actions is beneficial for cross-border e-commerce in Shenzhen SaaS、 The overseas gaming platform is particularly urgent. The format requirements for filing materials by the Guangdong Provincial Cyberspace Administration are relatively detailed, and it is recommended to prepare in advance by comparing with the official template. For more industry compliance information, please refer to Legal Industry News - Latest Legal and Regulatory Interpretations and Practices, as well as updates on the Industry Delivery section.

The consequences of not filing: deadline for rectification, fines, and suspension of business may all come

Failure to fulfill the obligation of filing standard contracts constitutes a violation of Article 38 of the Personal Information Protection Law, and regulatory authorities may handle it in accordance with Article 66. The common law enforcement rhythm is to first order rectification within a specified time limit, and then impose fines if the rectification is not made within the time limit; If the circumstances are serious, the relevant business shall be suspended directly. For platforms, suspending data transmission may mean a halt to overseas business, with losses far exceeding compliance costs. We usually recommend that customers complete their outbound compliance before the business goes live, rather than waiting for a rectification notice to be received before making up for it.

In addition, standard contract filing is not "one backup forever". Bankruptcy of overseas recipients, mergers and acquisitions, and the introduction of new data laws in the host country may all trigger reassessment. The platform needs to designate a dedicated person to track these changes. When serving Shenzhen platform enterprises, the team of Lawyer Shen Jinlong (Guangdong Zhiming Law Firm) usually handles data export compliance andShen Jinlong LawyerThe package of year-round legal advisory services mentioned on the introduction page reduces the cost of repeated communication.

Author: Lawyer Shen Jinlong, Guangdong Zhiming Law Firm. For data export compliance, platform responsibility sorting, and drafting of standard contract filing materials, please call the consultation hotline at 0755-25986969 to make an appointment for communication. Guangdong Zhiming Law Firm is located in Shenzhen and serves clients nationwide.

Disclaimer: This article is a general sharing of legal information and does not constitute a legal opinion or individual commitment on any specific matter. The compliance of data export needs to be judged based on the actual business of the platform, data fields, and the situation of overseas recipients. For specific operations, please consult a practicing lawyer. The term, amount, and proportion mentioned in the article are subject to the current effective laws, regulations, and regulatory authorities' standards. Regulatory updates may lead to changes in conclusions.