The CAC’s September 2026 Q&A discusses certification and assessment. Identify data types, recipients, access and volumes before choosing a compliance route.
Establish what actually happens
The CAC’s Q&A of 11 September 2026 discusses personal-information export certification, assessments when volumes increase and pre-application obligations. It says splitting volumes must not avoid a required security assessment. A small list or an internal colleague does not establish compliance.
Prepare a data-flow record
- Origin: forms, sales records, orders, logistics documents or other sources.
- Content: contact details, identity and payment information separately; file names are not enough.
- Access: overseas entities, team locations, permissions, downloads and onward sharing.
- Purpose: business need, retention, necessary fields and deletion.
Then assess the route
Vanmei recommends professional review of personal information, sensitive information, important data, entity status, volumes and applicable conditions. Certification, standard-contract and security-assessment requirements cannot be decided by a generic checklist alone.
Check applicable notice, consent and impact-assessment duties before sharing. This article supports preparation; it does not establish compliance or an exemption for a business.
Sources
- Data-export security Q&A, September 2026国家互联网信息办公室 / CAC ·
Prepared from the public sources listed below. Source facts and Vanmei’s practical recommendations are identified separately. Check product availability, regulatory scope and subsequent changes with the originating organisation.