On 24 February 2023, the Cyberspace Administration of China (CAC) released the final version of the Measures on the Standard Contract for the Cross-border Transfer of Personal Information (Measures), including a template contract (Standard Contract) accompanying the Measures. The Measures will take effect on 1 June 2023, but are subject to a six-month grace period to allow companies time to bring their activities into compliance.

Under the Measures, if an in-country personal information processing entity (equivalent to the concept of a “data controller” under the EU’s General Data Protection Regulation) needs to adopt the Standard Contract as its lawful transfer mechanism, namely as a “data exporter,” this entity is required to submit a filing to the provincial branch of CAC. This filing includes: