Meaning
Standardized legal instruments issued by national cyberspace regulators establish uniform contractual obligations for cross-border personal data transfers between domestic exporters and foreign recipients. The standard contract provides a prescribed legal mechanism under the Personal Information Protection Law for medium-scale data exports that do not trigger mandatory central security assessments. Contractual terms are fixed by state authorities and cannot be altered or limited by supplemental commercial agreements between contracting parties.
Executing this instrument binds both domestic and overseas parties to explicit data protection standards, subject to administrative recordal with provincial regulators.
Contractual Framing
Mandatory contract provisions mandate that the foreign recipient protect personal information according to standards equivalent to Chinese statutory requirements. The standard contract obligates the offshore party to accept Chinese administrative jurisdiction, submit to regulatory audits, and resolve contract disputes through designated domestic arbitration centers or competent Chinese courts. Supplemental clauses added by commercial entities can address broader commercial terms but must never contradict, weaken, or restrict the core data protection obligations set forth in the official state template.
Filing Procedure
Onshore exporting entities must file the executed contract alongside a personal information protection impact assessment with provincial cyberspace authorities within ten working days of execution. Failure to complete administrative filing renders the contract ineffective as a legal basis for outbound data transfers.
Remedial Mechanism
Breach of contract terms empowers domestic data subjects to enforce third-party beneficiary rights directly against foreign recipients. Chinese courts enforce mandatory compensation remedies for privacy rights violations caused by foreign non-compliance.
