How long each data export route takes in China

A security assessment of a data export from China has a statutory review period of 45 working days, counted from the written notice of acceptance, and the period can be extended.¹ A standard contract is filed within 10 working days after it takes effect.² A certificate for certified exports is valid for 3 years.³

Each of these numbers is a statutory clock. None of them measures a project, because the preparation comes before the clock starts and the assessment clock can be extended. A reader used to fixed review goals at FDA or to a notified body’s contractual timetable will find no equivalent commitment here.

The security assessment, step by step

The 2022 security assessment measures set the procedure, and the 2024 cross-border provisions changed the thresholds and the period of validity.¹⁴

1. The processor carries out a self-assessment of the risks of the export before it files.¹
2. The processor files through the provincial cyberspace department. The filing contains a declaration, the self-assessment report, the legal documents to be concluded with the recipient and other materials the assessment needs.¹
3. The provincial department checks completeness within 5 working days of receiving the filing. It forwards a complete filing to the national department and returns an incomplete one with a single list of what is missing.¹
4. The national department decides whether to accept the filing within 7 working days of receiving it, and notifies the processor in writing.¹
5. The national department completes the assessment within 45 working days of issuing the written notice of acceptance.¹

Article 12 allows the 45 working days to be extended where the case is complex or where materials have to be supplemented or corrected. The department tells the processor the expected length of the extension.¹ The measures set no outer limit on it.

Article 11 governs supplements. The national department may require the processor to supplement or correct the filing, and may end the assessment where the processor fails to do so without good reason.¹ A processor that knowingly submits false materials is treated as having failed the assessment.¹

Challenging a result

Article 13 gives the processor 15 working days from receipt of the result to apply to the national department for a re-assessment. The result of the re-assessment is final.¹

How long a result lasts

Article 9 of the 2024 provisions sets the validity of a passed assessment at 3 years from the date the result is issued.⁴ The 2022 measures had set it at 2 years.¹ Where the 2022 measures and the 2024 provisions differ, the 2024 provisions apply.⁴

A processor that needs to continue exporting may apply to extend the result. The application is made through the provincial department within the 60 working days before expiry, and the national department may extend the result by 3 years.⁴ The extension is available only where nothing has occurred that requires a fresh filing.⁴

The circumstances in Article 14 of the 2022 measures that require a fresh filing during the period of validity include the following.¹

• a change in the purpose, method, scope or categories of the export, or in how the recipient uses the data, that affects security
• a longer retention period abroad for personal information or important data
• a change in the data security laws or the cybersecurity environment of the recipient’s country or region
• a change in who controls the processor or the recipient in fact
• a change to the legal documents between the processor and the recipient that affects security

Two months for important data

A processor may learn that data it already exports is important data. The Cyberspace Administration has stated, in questions and answers published in October 2025, that such a processor must file for a security assessment within 2 months of being told or of the data being published as important data.⁵ The period comes from that guidance. It appears in no order.

The standard contract

Article 5 of the 2023 standard contract measures requires a personal information protection impact assessment before the transfer.² Article 6 requires the contract to follow the text annexed to the measures, and allows further terms that are consistent with it. The export may begin only after the contract takes effect.²

Article 7 requires the processor to file with the provincial cyberspace department within 10 working days of the contract taking effect. The filing contains the contract and the impact assessment report.²

The changes in Article 8 that require a new impact assessment, a supplemented or new contract and a new filing include the following.²

• a change in the purpose, scope, categories, sensitivity or method of the export
• a change in the place of storage
• a change in how the recipient uses or processes the information
• a longer retention period abroad
• a change in the personal information protection policies and laws of the recipient’s country or region that may affect individual rights

The Cyberspace Administration has stated that one filing suffices where the processor deals with a single recipient and expects its yearly volume to stay within the conditions for a standard contract.⁵ A processor whose cumulative volume since 1 January reaches the threshold for a security assessment must file for one.⁵

Certification

The certification rules published in November 2022 set a model of technical verification, on-site audit and supervision after certification.⁶ The certification body decides on the basis of the application materials, the technical verification report and the on-site audit report.⁶ The rules leave the time limits to each certification body, which must set a limit for every stage and keep to it.⁶

The Measures for the Certification of Outbound Personal Information Transfers were issued on 14 October 2025 as Order No. 20 of the Cyberspace Administration and the State Administration for Market Regulation. They take effect on 1 January 2026.³ Article 5 opens certification to a processor outside the class of critical information infrastructure operators whose exports fall in the middle band of volume.³ Article 8 sets the validity of a certificate at 3 years and requires an application for renewal 6 months before expiry.³

Article 10 requires the certification body to suspend or revoke a certificate where the export no longer matches the certified scope.³ The Cyberspace Administration has named GB/T 46068-2025 as the national standard against which certification of exports is carried out.⁵

Questions people also ask

How long does a security assessment take in China?

The national cyberspace department must complete the assessment within 45 working days of its written notice of acceptance.¹ The period can be extended where the case is complex or materials have to be supplemented, and the measures set no limit on the extension.¹

How long is a passed security assessment valid?

A passed assessment is valid for 3 years from the date the result is issued, and may be extended by 3 years on application.⁴

When must a standard contract be filed?

The processor must file within 10 working days of the contract taking effect.² The export may begin once the contract is in effect.²

Can a failed assessment be appealed?

The processor may apply for a re-assessment within 15 working days of receiving the result, and the outcome of the re-assessment is final.¹

When do the 2025 certification measures take effect?

The Measures for the Certification of Outbound Personal Information Transfers take effect on 1 January 2026.³

Footnotes

1. Measures for the Security Assessment of Outbound Data Transfers (Cyberspace Administration of China Order No. 11), Articles 5 to 7 and 11 to 14. https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶

2. Measures on the Standard Contract for the Outbound Transfer of Personal Information (Cyberspace Administration of China Order No. 13), Articles 5 to 8. https://www.cac.gov.cn/2023-02/24/c_1678884830036813.htm ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

3. Measures for the Certification of Outbound Personal Information Transfers (Order No. 20 of the Cyberspace Administration of China and the State Administration for Market Regulation), Articles 5, 8 and 10. https://www.cac.gov.cn/2025-10/17/c_1762449728720008.htm ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

4. Provisions on Promoting and Regulating Cross-Border Data Flows (Cyberspace Administration of China Order No. 16), Articles 9 and 13. https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶

5. Cyberspace Administration of China, Data Export Security Management Policy Questions and Answers, October 2025. https://www.cac.gov.cn/2025-10/31/c_1763633376984070.htm ↩ ↩² ↩³ ↩⁴

6. State Administration for Market Regulation and Cyberspace Administration of China, Implementation Rules for Personal Information Protection Certification, published 18 November 2022. https://www.cac.gov.cn/2022-11/18/c_1670399936983876.htm ↩ ↩² ↩³