Chapter III Rules for Cross-border Provision of Personal Information
Article 38
Translation Notice
This is an unofficial English translation prepared for general informational purposes only. It does not constitute legal advice. In case of any discrepancy, the official Chinese text published by the competent authority shall prevail.
本文为非官方英文翻译，仅供一般信息参考，不构成法律意见。如与主管机关发布的中文正式文本不一致，以中文正式文本为准。
Chinese Original
第三十八条 个人信息处理者因业务等需要，确需向中华人民共和国境外提供个人信息的，应当具备下列条件之一： （一）依照本法第四十条的规定通过国家网信部门组织的安全评估； （二）按照国家网信部门的规定经专业机构进行个人信息保护认证； （三）按照国家网信部门制定的标准合同与境外接收方订立合同，约定双方的权利和义务； （四）法律、行政法规或者国家网信部门规定的其他条件。 中华人民共和国缔结或者参加的国际条约、协定对向中华人民共和国境外提供个人信息的条件等有规定的，可以按照其规定执行。 个人信息处理者应当采取必要措施，保障境外接收方处理个人信息的活动达到本法规定的个人信息保护标准。
English Translation
Where a personal information processor truly needs to provide personal information outside the territory of the People's Republic of China for business or other needs, it shall meet one of the following conditions: (1) it has passed the security assessment organized by the national cyberspace administration in accordance with Article 40 of this Law; (2) it has obtained personal information protection certification from a professional institution in accordance with the provisions of the national cyberspace administration; (3) it has concluded a contract with the overseas recipient according to the standard contract formulated by the national cyberspace administration, agreeing on the rights and obligations of both parties; or (4) other conditions provided by laws, administrative regulations, or the national cyberspace administration. Where international treaties or agreements concluded or acceded to by the People's Republic of China contain provisions on the conditions for providing personal information outside the territory of the People's Republic of China, those provisions may be followed. The personal information processor shall take necessary measures to ensure that the overseas recipient's processing of personal information reaches the personal information protection standards provided by this Law.
Plain English Note
Site explanation only. Not part of the translation.
Article 38 is the central cross-border personal information transfer gateway. It links overseas provision to security assessment, certification, standard contracts, or other statutory routes.