Q: Where personal information is exported through the exit certification of personal information, what circumstances should it meet? Answer: Personal information exit certification refers to the conformity assessment activity of a professional certification body that has obtained personal information protection certification qualifications in accordance with the provisions of Article 38 (1) (2) of the “Personal Information Protection Law of the People's Republic of China” to prove that personal information processing activities such as personal information provided by personal information handlers outside the People's Republic of China comply with relevant laws, administrative regulations, departmental rules, standards, and technical specifications. Non-critical information infrastructure operators that have provided more than 100,000 people, less than 1 million people, or sensitive personal information for less than 10,000 people since January 1 of the same year, and do not include important data, can fulfill data exit compliance obligations through personal information exit certification. In addition, personal information processors have personal information leaving the country. Regardless of the scale of personal information leaving the country, they can apply for personal information exit certification from a professional certification agency to prove that the relevant personal information processing activities meet the requirements of GB/T 35273 “Information Security Technology Personal Information Security Specification” and GB/T 46068 “Data Security Technology Personal Information Cross-border Processing Activity Safety Certification Requirements”, improving their level of compliance capabilities. What needs to be clarified is that personal information handlers must not use methods such as quantitative splitting to provide personal information that should have passed a data exit safety assessment to foreign countries by means of personal information exit certification.

Q: Where personal information is exported through the exit certification of personal information, what circumstances should it meet? Answer: Personal information exit certification refers to the conformity assessment activity of a professional certification body that has obtained personal information protection certification qualifications in accordance with the provisions of Article 38 (1) (2) of the “Personal Information Protection Law of the People's Republic of China” to prove that personal information processing activities such as personal information provided by personal information handlers outside the People's Republic of China comply with relevant laws, administrative regulations, departmental rules, standards, and technical specifications. Non-critical information infrastructure operators that have provided more than 100,000 people, less than 1 million people, or sensitive personal information for less than 10,000 people since January 1 of the same year, and do not include important data, can fulfill data exit compliance obligations through personal information exit certification. In addition, personal information processors have personal information leaving the country. Regardless of the scale of personal information leaving the country, they can apply for personal information exit certification from a professional certification agency to prove that the relevant personal information processing activities meet the requirements of GB/T 35273 “Information Security Technology Personal Information Security Specification” and GB/T 46068 “Data Security Technology Personal Information Cross-border Processing Activity Safety Certification Requirements”, improving their level of compliance capabilities. What needs to be clarified is that personal information handlers must not use methods such as quantitative splitting to provide personal information that should have passed a data exit safety assessment to foreign countries by means of personal information exit certification.