For a multinational, the hard part of China's data export rules is not knowing that three transfer routes exist; it is running them: counting individuals, deciding whether data is important, building the impact assessment, filing on time and keeping every flow, including log feeds and remote admin access, inside the route chosen. The China PIPL Guide already covers the legal bases, the March 2024 thresholds and penalties. This guide is the operational companion: how the Cyberspace Administration of China (CAC) applies the rules in practice after its April and May 2025 question and answer guidance, what each route's filing involves, how free trade zone negative lists change the picture, and how security and identity teams keep transfers under control. It is for privacy engineers, security architects and compliance leads at organisations with operations or users in mainland China. The 2024 Provisions were read on the CAC site; the security assessment procedure was read in the Stanford DigiChina translation; the 2025 guidance and free trade zone detail come from named law firm and advisory summaries because the CAC's original question and answer releases were not read. Confirm against the official text before relying on it.
Key takeaways
- Only two kinds of data are regulated for export. The CAC's 2025 guidance, as summarised by several law firms, says data that is neither personal information nor important data can flow freely; trade, logistics and manufacturing data without personal information is exempt under Article 3 of the 2024 Provisions.
- Count per year from 1 January. The 100,000, 1 million and 10,000 sensitive thresholds in Articles 7 and 8 of the 2024 Provisions are cumulative since 1 January of the current year, after the Article 5 exemptions are applied.
- Important data needs a trigger. Data not notified by the authorities or published in a catalogue as important does not need an important data assessment but once notified, a processor that wants to keep exporting must apply for a security assessment.
- Free trade zones can remove the filing altogether. Tianjin, Beijing, Shanghai, Zhejiang and Hainan have published negative lists; data outside a zone's list is exempt from all three routes for companies that qualify in that zone.
- Groups can file once. Affiliates with similar transfers can file a security assessment or standard contract through one representative entity, and certification can cover intra-group transfers without bilateral contracts.
The decision sequence
Article 13 of the 2024 Provisions says they prevail over the 2022 Security Assessment Measures and the 2023 Standard Contract Measures where they conflict, so the order below follows the 2024 text. Work through it per data flow, not per company.
- Is it regulated data? If the flow contains neither personal information nor important data, no route is needed (Art. 3). Personal information collected abroad, processed in China and sent back is also exempt if no domestic personal information or important data was added (Art. 4).
- Is it on a free trade zone negative list? If the exporter qualifies under a zone's list and the data is outside it, the flow is exempt (Art. 6).
- Does an Article 5 exemption apply? Contract performance with the individual (cross-border shopping, payments, travel, visas, exams), cross-border HR management under lawful labour rules, emergencies to protect life, health or property, or a non-CIIO exporter with fewer than 100,000 individuals' non-sensitive personal information since 1 January. Important data never benefits from these exemptions.
- Which threshold applies? Use the table below.
- Whatever the route: notice, separate consent and a personal information protection impact assessment (PIPIA) are still required (Art. 10).
| Exporter and volume since 1 January | Route | Source |
|---|---|---|
| Critical information infrastructure operator (CIIO), any personal information or important data | CAC security assessment | 2024 Provisions Art. 7 |
| Any processor exporting important data | CAC security assessment | Art. 7 |
| Non-CIIO, over 1 million individuals (non-sensitive) or over 10,000 individuals' sensitive personal information | CAC security assessment | Art. 7 |
| Non-CIIO, 100,000 to under 1 million individuals, or under 10,000 individuals' sensitive personal information | Standard contract (filed) or certification | Art. 8 |
| Non-CIIO, fewer than 100,000 individuals, no sensitive personal information | Exempt | Art. 5(4) |
Two counting points cause most errors. First, sensitive personal information has its own threshold, so 9,000 employees' health records can push a flow into the standard contract tier even when the non-sensitive count is tiny. Second, the HR exemption covers what is necessary for cross-border HR management; exporting the whole HR database to a global analytics platform is a different purpose and needs its own analysis.
Important data in practice
Important data is defined by domain, population, region, scale or sensitivity, where leakage could endanger national security, economic operation, social stability or public health. The CAC's 2025 guidance points processors to the national standard GB/T 43697-2024 on data classification and grading (Appendix G) for identification, and the May 2025 guidance noted that sector regulators are drafting their own identification standards, citing industrial and telecoms, geographic and statistical data among the examples, according to Loeb and Loeb.
- Safe harbour: where there is no public standard and no notice from the relevant department, a processor is not penalised for failing to identify important data (Loeb and Loeb, May 2025 guidance). Article 2 of the 2024 Provisions says data not notified or publicly designated as important need not go through an assessment as important data.
- Once notified: a processor that wants to keep exporting must submit a security assessment within a deadline set in the guidance (Loeb and Loeb); confirm the period in the CAC text.
- Approval is not automatic: two independent summaries of the CAC's May 2025 figures agree that, as of March 2025, 44 completed assessment projects involved important data and 7 of them failed, and that 325 of the 509 important data items covered were allowed to leave.
Practical consequence: keep a classification record that shows you assessed datasets against GB/T 43697-2024 and any sector catalogue, even where the conclusion is "not important data". See the China Data Security Law and Network Data Security Regulations Guide.
Running each route
| Step | Security assessment | Standard contract | Certification |
|---|---|---|---|
| Who decides | National CAC, application through the provincial CAC | Filed with the provincial CAC | A CAC-approved certification body |
| Before applying | Risk self-assessment covering six items, including legality and necessity, scale and sensitivity, and the recipient's measures (2022 Measures Art. 5) | PIPIA using the CAC template, completed shortly before filing (Zhong Lun) | PIPIA and the certification body's requirements |
| Materials | Application letter, self-assessment report, the legal document with the recipient, other materials (Art. 6) | Signed standard contract following the CAC template without conflicting changes, PIPIA report, authorisation and undertaking letters | As set by the certification body |
| Timeline | Provincial completeness check within 5 working days; national acceptance decision within 7 working days; assessment within 45 working days of acceptance, extendable (Arts. 7 and 12) | File within 10 working days of the contract taking effect | Set by the body |
| Validity | Three years; extension request up to 60 working days before expiry (2024 Provisions Art. 9) | While the contract remains valid; update on changes in purpose, recipients, server location and similar conditions | Three years under the 2026 certification measures (see the China PIPL Guide) |
What the assessment looks at
Article 8 of the 2022 Measures lists seven areas, including the legality and necessity of the transfer, the data protection and cybersecurity environment of the recipient's country, the scale and sensitivity of the data, and whether rights are fully and effectively ensured. The 2025 guidance, as summarised by Arnold and Porter and DLA Piper, adds a necessity lens: whether the transfer itself is necessary, whether the number of individuals is proportionate to the purpose, and whether the categories of personal information are limited to what is needed. Expect questions on why the data must leave China rather than be processed there.
What the recipient contract must contain
For a security assessment, Article 9 of the 2022 Measures requires the legal document with the recipient to cover at least: purpose, method and scope; storage location and period; limits on onward transfer; security measures if control, operations or the legal environment change; liability and dispute resolution; and emergency response and channels for individuals to exercise rights. These are good drafting points for any China data processing agreement.
Free trade zone negative lists
Article 6 lets pilot free trade zones publish negative lists of data that must go through a route; data outside the list is exempt. Arnold and Porter, DLA Piper, Loeb and Loeb and China Briefing all report lists from Tianjin, Beijing, Shanghai, Zhejiang and Hainan, and the CAC guidance says a zone may adopt another zone's list for the same sector.
| Zone | Sectors reported | Operational note |
|---|---|---|
| Beijing (list from August 2024) | Automotive, pharmaceuticals, civil aviation, retail and modern services, AI training data | China Briefing reports an application to the local zone group with a short audit window |
| Shanghai (Lingang) | Reinsurance, international shipping, commerce including retail, food and beverage and hotels | Use ends if the company is penalised or relocates out of the zone (China Briefing) |
| Tianjin | Cross-industry data categories with personal information thresholds | Self-check against a dynamically adjusted list |
| Zhejiang | B2B e-commerce, clearing and settlement | Implementation rules in draft in late 2025 |
| Hainan | Deep sea, aviation, agriculture, tourism, duty-free retail | Relies on service centres and national rules |
China Briefing also reports later lists in Jiangsu (pharmaceuticals), Chongqing (automotive) and Guangxi. Negative lists only help entities registered and operating in the zone; check each zone's implementation rules before relying on one.
Where security and identity teams fit
Most unplanned exports are technical, not contractual. Each of these is a transfer that must sit inside a route or an exemption:
- Log and telemetry feeds: SIEM, EDR and application logs from China systems often hold user IDs, IP addresses and names. Shipping them to a global SOC is an export. Filter or pseudonymise at source, or run a regional collector. See the Log Management and Retention Guide.
- Remote administrative access: overseas administrators and support engineers viewing data in China systems can be part of the transfer analysis; Zhong Lun warns that shared IT that gives overseas staff access to another entity's data affects who the processor is. Inventory overseas admin roles and restrict them to what the route covers.
- Directory and identity sync: a global identity provider that syncs China employees' profiles is an HR transfer; keep attributes to what HR management needs.
- Service accounts and API keys: integrations that pull China data to overseas SaaS run under non-human identities. Tag each with the transfer route it relies on, scope it to the approved data and log its reads, so volumes can be counted. See the Data Sovereignty and Residency Guide.
- AI tools and agents: prompts that include China personal information sent to models hosted abroad are exports; route China users to regionally hosted services or strip personal information first.
Implementation plan
- Map flows (weeks 1 to 4): build a register of every outbound flow: system, data categories, sensitive data, recipient, country, purpose and the technical path (API, log feed, remote access).
- Classify: assess datasets against GB/T 43697-2024 and sector catalogues; record important data conclusions.
- Apply exemptions and count: remove Article 3, 4 and 5 flows, check negative lists, then count individuals per category from 1 January using system-of-record counts, not estimates.
- Choose and file: pick the route per flow, prepare PIPIAs and file standard contracts within 10 working days of effect; allow for the assessment timeline before go-live where an assessment is needed.
- Control: enforce the register technically with egress controls, regional log collectors and scoped service identities.
- Monitor and re-file: track volumes monthly against thresholds and re-file on changes in purpose, recipients or server location.
Small versus large: a company with a few thousand China customers and an HR exemption may need no filing, but still needs notice, separate consent and a PIPIA. A large platform or CIIO should plan for the security assessment, or localise processing so the transfer disappears. Groups should use the single-representative filing and consider certification for intra-group flows.
Measurement and framework mapping
- Register coverage: percentage of outbound flows from China with an assigned route or exemption.
- Threshold headroom: current year-to-date counts against 100,000, 1 million and 10,000 sensitive, reviewed monthly.
- Filing currency: filings updated within 10 working days of a material change.
- Unregistered egress: flows detected at the network or SaaS layer that are not in the register.
| Activity | NIST CSF 2.0 | NIST SP 800-53 Rev 5 |
|---|---|---|
| Track Chinese legal requirements | GV.OC-03 | PT-2 |
| Map data flows and inventory data | ID.AM-03, ID.AM-07 | CA-3, CM-8 |
| Recipient contracts and supplier requirements | GV.SC-05 | SA-9 |
| Protect data in transit and control sharing | PR.DS-02 | AC-21 |
The mapping is ours, to help reuse control evidence.
Common failure patterns
- Counting once: thresholds reset each 1 January and accumulate through the year; a flow can cross a tier in October.
- Treating HR as unlimited: the exemption is tied to cross-border HR management, not every use of employee data.
- Forgetting technical flows: logs, backups, support tickets and remote access are exports too.
- No important data record: without a documented classification, the safe harbour is hard to show.
- Stale filings: new recipients, purposes or server locations without an update.
Practitioner checklist
- Register every outbound flow from China, including logs, remote access and service integrations.
- Record important data classification against GB/T 43697-2024 and sector catalogues.
- Apply Article 3 to 6 exemptions and free trade zone lists before counting.
- Count individuals per category from 1 January and track monthly.
- Prepare PIPIAs, notices and separate consent for every regulated flow.
- File standard contracts within 10 working days and diarise assessment expiry and extension windows.
- Scope overseas admin roles and non-human identities to approved data and log their access.
- Recheck CAC guidance and zone lists every quarter.
Standards and references
- Cyberspace Administration of China: Provisions on Promoting and Regulating Cross-Border Data Flows
- Stanford DigiChina: Translation, Outbound Data Transfer Security Assessment Measures
- China Law Translate: Translation, Measures on the Standard Contract for the Export of Personal Information
- CMS: China issues Measures for the Certification of the Cross-Border Transfer of Personal Information
- Arnold and Porter: China clarifies cross-border data transfer rules
- DLA Piper: China CAC publishes official Q&As for cross-border data transfer regulation
- Loeb and Loeb: China's CAC answers questions on cross-border data transfer in April and May guidance
- Zhong Lun: Ten key questions to navigate the standard contract guidelines
- China Briefing: The negative lists easing data export in China's FTZs
Related NHI Mgmt Group resources: China PIPL Guide · China Data Security Law and Network Data Security Regulations Guide · International Data Transfers Map · China Personal Information Protection Compliance Audits. This guide summarises China's cross-border data transfer rules as checked on 9 November 2026 and is not legal advice.