On 11 September 2026 the Cyberspace Administration of China (CAC) published its Q&A on data export security management (September 2026). Its sharpest line is aimed at one tactic. Personal information processors may not use "volume splitting" or similar means to push data that legally needs a CAC security assessment through the lighter certification route. That is a small textual change with large practical consequences for any company that moves Chinese user data abroad.
What the Q&A actually says
The thresholds are cumulative and run from 1 January of the current year. A non-CIIO processor that has sent abroad personal information of at least 100,000 but fewer than 1 million individuals (excluding sensitive data), with no important data involved, can use certification. Once cumulative exports reach 1 million individuals, or personal information of 10,000 individuals counts as sensitive, the processor must file for a security assessment through its provincial CAC office.
The September text bars splitting only on the certification route. Its wording targets processors that carve up volumes so that data which should go to assessment instead goes through certification. We could not find that clause extended in the same words to every export mechanism, and readers should not assume it is. The January 2026 CAC Q&A points the same way in practice. It says exports already made under standard contracts or certification count toward the total, and that they must be included in the assessment filing once the threshold is crossed.
Processors below the lower thresholds can still be exempt from certification and filing, provided no important data is involved. That exemption comes from the 2024 liberalisation of the regime, and the September Q&A leaves it intact.
The case for the regulator
The strongest argument for the rule is that a threshold system without an anti-avoidance principle is a formality. If a company with 3 million users could cut its transfers into many contracts or certificates, a 1 million-person trigger would measure paperwork structure rather than risk. The CAC's concern is legitimate: the assessment exists because large aggregate flows carry risks of a different kind than small ones. Counting cumulatively is a reasonable way to capture that.
Why enforcement changes the stakes
This Q&A arrives after a first major penalty. In June 2026 the Shanghai CAC fined Ctrip RMB 10 million for failing to implement required cross-border security assessments and for illegally transferring personal data overseas, with an order to rectify. China Briefing describes it as a record for a cross-border transfer violation. It also notes that the regulator did not specify how Ctrip breached the rules, and that Ctrip's cooperation and full rectification were noted in the announcement.
The Personal Information Protection Law (PIPL) allows fines of up to RMB 50 million or 5% of prior-year turnover for serious violations. Both secondary sources cite that ceiling. Ctrip's fine is a fifth of the monetary cap, but the signal matters more than the number. Regulators now penalise missed assessments, and the anti-splitting language tells companies that how they structure their filings will be examined as well.
Where proportionality strains
A pro-innovation reading has to be candid about the costs. Three problems stand out.
- Opacity. The Ctrip announcement did not explain what conduct crossed the line. Compliance teams cannot calibrate against a penalty notice that does not state the violation. Published enforcement reasoning is cheap to produce and would do more for compliance than another fine.
- Cumulative counting is operationally hard. Counting unique individuals across the calendar year, across subsidiaries, vendors and products, is a data-governance project. Large multinationals can do it. A mid-sized exporter or a Chinese start-up serving overseas customers may struggle, and the rule falls hardest on those least able to carry the compliance overhead.
- Route-specific wording leaves a gap in understanding. If the splitting ban is written for certification, what does it imply for standard contracts? Over-compliance is the likely answer: firms will treat the ban as universal because the penalty for guessing wrong is high.
The regime is also not the only one that matters to open-internet advocates. Data localisation and heavy transfer controls fragment the network and raise costs for research, services and trade. Even a reasonably administered threshold system adds friction for cross-border cloud services, remote teams and global customer support. A government can reasonably defend a security assessment for very large aggregate flows while still keeping the lower tiers light, and the 2024 relaxation showed that Beijing understands this trade-off.
What proportionate implementation looks like
The CAC can reinforce the anti-avoidance principle without adding burden. First, publish reasoned penalty notices that identify the specific conduct and the threshold crossed. Second, state in one place whether the splitting ban applies across all export routes. Third, provide a standard method for counting individuals across affiliated entities, so that firms are measured by one yardstick rather than by guesswork.
For companies, the lesson is practical. Build a single cumulative ledger of outbound personal information from 1 January, count sensitive data separately, and map it to the certification and assessment lines before the year-end. Treat any plan that depends on keeping each transfer just below a limit as a liability. Under the September Q&A, the question a regulator will ask is no longer whether each export fit a category. It is whether the total did.
China's regime has moved from a paper framework to a system with a documented enforcement case and a stated anti-avoidance rule. Predictability is the missing piece, and that is a gap the CAC can close at low cost.