Introduction
Cross-border data questions are usually operational questions: which data is collected, where it is stored, who receives it, why it is transferred and what procedure is required. The answers below use the Data Security Law, the 2024 Provisions on Promoting and Regulating Cross-Border Data Flows and the Cyberspace Administration of China policy Q&A published in January 2026. They are a general research aid, not a legal opinion.
15 Key Questions
1. Does every transfer of data outside China require a security assessment?
No. The 2024 rules create several situations that do not require the relevant security assessment, standard contract or certification route, but the conditions must be checked against the actual transfer. Recommendation: map the data, purpose, recipient and legal basis before deciding that an exemption applies.
2. What is the first step for a foreign company?
Create a data-flow map covering collection, storage, access, transfer, recipient and retention. Recommendation: identify personal information, sensitive personal information and any data that may be important data before selecting a transfer mechanism.
3. What if data is collected during international trade or cross-border manufacturing?
The CAC rules identify certain international trade, cross-border transport, academic cooperation, multinational production and marketing situations as possible exemptions where the data does not contain personal information or important data. Recommendation: document the content of the data rather than relying only on the business label.
4. Is employee HR data automatically exempt?
The official rules identify cross-border human-resources management carried out under legally adopted labor rules and collective contracts as one possible exemption where employee information must be provided overseas. Recommendation: confirm the HR purpose, employee notice, internal rules and actual fields transferred.
5. What is important data?
Important data is determined under the relevant data-security framework and sector or local identification arrangements. The 2024 CAC explanation states that data not notified or publicly identified as important data does not need to be declared as important data solely on that basis. Recommendation: retain the identification analysis and check sector guidance.
6. What transfer volume can trigger a security assessment?
The official CAC materials distinguish critical information infrastructure operators and other data processors and set different thresholds for personal information and sensitive personal information. The January 2026 policy Q&A should be checked for the current wording before a company relies on a threshold. Recommendation: calculate annual cumulative transfers and keep the calculation record.
7. When may a standard contract or certification be relevant?
For certain transfers by data processors that do not reach the security-assessment threshold, the official framework provides a route through a personal-information export standard contract or personal-information protection certification. Recommendation: confirm which route applies and complete the required filing or certification steps.
8. Does the company need to check whether it is a critical information infrastructure operator?
Yes. The regulatory path differs for critical information infrastructure operators. Recommendation: do not assume status; ask the responsible authority or qualified adviser when the business operates in a regulated sector or handles sensitive systems.
9. Can a free trade zone have different data rules?
The 2024 rules establish a mechanism for free trade zones to formulate data-outbound negative lists within the national framework, subject to the stated approval and filing process. Recommendation: verify the specific zone list and its effective status rather than assuming every FTZ has the same treatment.
10. Is employee consent the only requirement?
No. Consent or notice is only one part of a broader compliance analysis. The data purpose, legal basis, protection impact assessment, transfer arrangement, retention and security controls must also be reviewed. Recommendation: keep the HR and data-security records together.
11. Can a global CRM be used for China data?
A global system may be usable, but the company must assess where data is collected, stored, accessed and transferred and whether the actual fields include personal or important data. Recommendation: review the system architecture and data fields before launch.
12. What should be done when the receiving group company changes?
A change in recipient, purpose, scope, retention period or legal documents may affect the original analysis. Recommendation: trigger a change review before the new transfer begins.
13. How should the company prepare for an official query?
Keep the data map, classification analysis, transfer records, notices, contracts, impact assessment, security controls and approval history. Recommendation: store one controlled evidence pack with a clear owner.
14. Can an overseas headquarters access data remotely?
Remote access can still involve a transfer analysis depending on the data, access arrangement and actual processing. Recommendation: include remote access, support access and administrator access in the data-flow map.
15. What is the safest next step?
Classify the data, identify the transfer route, calculate cumulative volumes, check the current CAC rules and confirm any sector or local requirements. Recommendation: obtain specialist advice for sensitive, important or high-volume data.
Practical Evidence Checklist
- Data-flow diagram with systems, locations and recipients.
- Data inventory and classification record.
- Annual transfer-volume calculation.
- Personal-information protection impact assessment where required.
- Internal rules, notices, contracts and security controls.
- Approval and change-review record.
Conclusion
The question is not simply whether data crosses a border. The company must understand what data moves, why it moves, who receives it, how much moves and which official procedure applies. Recheck the CAC rules before launch and after any material system or business change.
Sources and Review Date
- Cyberspace Administration of China, Data Security Law – data-security duties and framework.
- Cyberspace Administration of China, Provisions on Promoting and Regulating Cross-Border Data Flows, published 2024-03-22 – exemptions, thresholds and FTZ mechanism.
- Cyberspace Administration of China, Data Export Security Management Policy Q&A, January 2026 – current policy explanations and route distinctions.
Last reviewed: 2026-07-14
