Cross-Border Data Transfer

Cross-border data transfer from China: the short answer

Cross-border data transfer from mainland China is regulated only for two categories of data: personal information and important data. Other data, such as ordinary business, technical or financial information that identifies no individual and has not been designated as important, can generally flow abroad freely. For personal information, the question is which of three routes applies: an exemption, a filed standard contract or certification, or a security assessment by the Cyberspace Administration of China (CAC). For important data, a CAC security assessment is required unless the data falls outside a negative list in a pilot free trade zone.

The rules come from the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law (PIPL), implemented by the Measures for Security Assessment of Outbound Data Transfers (2022), the Measures on the Standard Contract for Outbound Transfer of Personal Information (2023), the Provisions on Promoting and Regulating Cross-Border Data Flows (in force since 22 March 2024), the Network Data Security Management Regulations (2025) and the Measures for Personal Information Export Certification (in force since 1 January 2026).

The 2024 Provisions changed the landscape. They removed many routine transfers from the regime entirely and raised the thresholds for the heavier mechanisms. For most foreign-invested enterprises, cross-border data transfer is now a matter of careful documentation rather than lengthy approvals.

Cross-border data transfer thresholds and exemptions

Thresholds are counted by the number of individuals whose personal information is transferred, cumulatively from 1 January of the current year, by the relevant processor. Sensitive personal information is counted separately. The table summarises the position for a processor that is not a critical information infrastructure operator (CIIO).

The statutory exemptions in the 2024 Provisions are broad. Personal information may be exported without any mechanism where it is necessary to conclude or perform a contract to which the individual is a party (for example cross-border shopping, delivery, payment, account opening, flight and hotel bookings, visas and examinations); where it is necessary for cross-border human resources management under lawful labour rules and collective contracts; where it is necessary in an emergency to protect life, health or property; and where the volume is below 100,000 individuals and no sensitive information is involved.

Data collected and generated abroad that is processed in China and sent back, without adding domestic personal information or important data, is also exempt, as is non-personal data generated in international trade, cross-border transport, academic cooperation and cross-border manufacturing and sales.

Two cautions apply. First, exemptions remove the need for a mechanism, not the PIPL's other duties: notice, separate consent for the transfer, and a personal information protection impact assessment remain necessary. Second, a processor may not split data or transfers to stay under a threshold. The CAC's Q&A guidance also stresses necessity: regulators will ask whether the transfer itself, the number of individuals and the data fields are all necessary for the stated purpose.

The CAC security assessment

The security assessment is the heaviest route. The exporter first conducts a self-assessment covering the legality, legitimacy and necessity of the transfer, the volume, scope and sensitivity of the data, the risks to national security, public interests and individuals, the recipient's protections and the legal environment in the recipient's country, and the contract with the recipient. It then applies through the provincial cyberspace authority, which checks completeness before passing the file to the CAC. The CAC aims to complete the assessment within 45 working days of accepting the application, although complex cases can take longer.

Approvals are valid for three years, extended from two years by the 2024 Provisions, and an exporter can apply to extend validity before expiry where nothing material has changed. A new application is required if the purpose, method, scope or type of data changes, if the retention period abroad is extended, or if other circumstances affecting security arise. The CAC has issued a third edition of its application guide, simplifying the documents required, and pre-assessment consultation is available in 14 provinces, including Guangdong.

The process is not a formality, but nor is it a barrier. The CAC reported in April 2025 that it had completed 298 assessment projects, and that of the 44 involving important data, 7 had not been approved, while 325 of 509 important data items were approved. The lesson is that preparation, especially a clear explanation of necessity and data minimisation, drives the result.

Localisation duties

Separately from the transfer mechanisms, some data must be stored in China in the first place. Under the Cybersecurity Law, critical information infrastructure operators must store personal information and important data collected and generated in their operations within China, and may export it only after a security assessment. Sector rules impose localisation for categories such as personal financial information, credit reporting data, population health information and surveying and mapping data, and some of these sectors require regulator approval before any export. Before choosing a cross-border data transfer mechanism, therefore, check whether the data can lawfully be held abroad at all, or whether the right design is to keep the master copy in China and export only what is necessary, such as aggregated reports or pseudonymised data.

Standard contract and certification

Standard contract

The CAC standard contract is the most common mechanism for mid-volume transfers. The exporter and the overseas recipient sign the contract in the CAC's prescribed form, without altering its terms (additional commercial terms can be agreed if they do not conflict). The exporter completes a PIPIA and files the contract and assessment report with the provincial cyberspace authority within 10 working days after the contract takes effect. The contract gives individuals third-party beneficiary rights, restricts onward transfers, requires the recipient to accept CAC supervision in some respects, and is governed by PRC law. Groups with several China entities should confirm under current CAC filing guidance whether each entity files separately or whether filings can be coordinated.

Certification

The Measures for Personal Information Export Certification, issued by the CAC and SAMR and effective 1 January 2026, formalise certification as an alternative to the standard contract within the same thresholds. An approved professional certification body assesses the processor's export activity against national certification rules, and certificates are valid for three years, with a renewal application due six months before expiry. If the processor's transfers move outside the certified scope or it no longer meets requirements, the certificate can be suspended or revoked.

By March 2026 the CAC had approved three certification institutions. Certification is particularly useful for multinational groups with many similar intra-group transfers, and an overseas processor that falls within the PIPL's extraterritorial scope can apply through its dedicated entity or designated representative in China.

Free trade zones, the Greater Bay Area and sector rules

Pilot free trade zones may publish "negative lists" of data that requires a mechanism to leave China; data not on the list can be exported from the zone without a security assessment, standard contract or certification. According to the CAC's March 2026 review, nine free trade zones (Tianjin, Beijing, Hainan, Shanghai, Zhejiang, Guangxi, Jiangsu, Chongqing and Fujian) have published lists covering 22 sectors, including automotive, retail, civil aviation, reinsurance and seed industry, and other zones may adopt an existing list for the same sector. A company must be registered in the zone to rely on its list.

Within the Greater Bay Area, the Mainland and Hong Kong operate a simplified standard contract for personal information flows between the nine Guangdong cities and Hong Kong, and Guangdong has published a filing guide. It is available only for flows within the area and requires both parties to be registered there. See our Greater Bay Area hub.

Sector regulators have added specific guidance. In April 2025 the People's Bank of China and other agencies issued a compliance guide for financial data flows with a list of data items that may be exported. In February 2026 MIIT and other agencies issued automotive data export guidelines that address identification of important data and exemptions in vehicle manufacturing and connected-vehicle operations; see connected vehicle and automotive data.

Foreign authority requests and conflicting laws

A separate rule applies when data is sought by foreign courts, regulators or law enforcement. Article 36 of the Data Security Law and Article 41 of the PIPL prohibit providing data or personal information stored in China to foreign judicial or law enforcement bodies without approval from the competent PRC authorities. This affects US discovery, SEC or DOJ investigations, EU competition inquiries and customs requests, including forced labour inquiries (see supply chain due diligence and forced labour rules). The usual approach is to engage with the foreign authority early about the PRC constraints, to use international judicial assistance channels where available, and to obtain PRC advice before any production.

Recipients abroad face their own rules. A US recipient of bulk sensitive personal data must consider the US Department of Justice rule on data transactions with countries of concern, and an EU recipient remains subject to the GDPR. Chinese groups exporting data to their own overseas subsidiaries must also satisfy the importing country's laws. A good cross-border data transfer design therefore looks at both ends of the pipe.

A step-by-step cross-border data transfer plan

1. Map flows. List every outbound flow by China entity, system, recipient, data category and purpose, including remote access.
2. Classify data. Separate non-personal, personal, sensitive and potentially important data. Check sector catalogues and any notices from regulators.
3. Apply exemptions. Identify flows covered by the contract, HR, emergency or low-volume exemptions, and document why.
4. Count individuals. For the remaining flows, count individuals cumulatively from 1 January, separately for sensitive data.
5. Select mechanisms. Choose standard contract, certification or security assessment; consider a free trade zone list or the GBA contract if available.
6. Complete formalities. Prepare notices and separate consents, the PIPIA, contracts and filings; diarise renewals.
7. Monitor. Recount at least annually and whenever a new system, vendor or product launches.

For the underlying obligations see personal information protection (PIPL) and important data and data security.

Worked example and common cross-border data transfer mistakes

Consider a European industrial group with a manufacturing subsidiary in Shenzhen. It employs 3,000 people in China, sells to about 2,000 business customers and runs a consumer warranty programme with 300,000 registered users. Global HR, CRM and warranty systems are hosted in Germany.

• HR data for employees is exempt as cross-border human resources management, provided the employee handbook and labour rules support it, although notice and an impact assessment are still needed. Health data and other sensitive categories should be minimised.
• Customer contact data for business customers is personal information of a few thousand individuals, well under 100,000, so it is exempt on volume.
• Warranty user data covers 300,000 individuals, so the group needs a standard contract filing or certification for that flow, plus separate consent from users.
• Production and quality data that identifies no individual is not regulated for export unless the sector catalogue or a regulator's notice designates it as important data.

The mistakes that most often cause problems in a cross-border data transfer review are counting records rather than individuals, forgetting remote access and support tools, assuming that an exemption removes the need for consent and notice, splitting flows between entities to stay under thresholds, and failing to diarise renewals and recounts. Another common gap is the recipient side: the overseas entity must actually be able to honour the standard contract, including deletion on request and cooperation with the regulator, so its own processes need to be checked too.

How TRW & Co helps

TRW & Co's Shenzhen office helps multinationals and Chinese groups design cross-border data transfer structures that work at both ends. We map data flows, design intra-group transfer frameworks, align China instruments with GDPR transfer tools and other non-PRC requirements, negotiate data terms with vendors and counterparties, and manage the timetable for filings and renewals. Where PRC legal advice, CAC security assessment applications, standard contract filings or certification are needed, we work alongside licensed PRC law firms and coordinate the combined team, so that group IT, legal and business teams receive one consistent plan. Contact us to discuss your data flows.