How to Comply with Health Data Rules in China: 2026 Guide for Foreign Businesses

Foreign businesses handling health data in China must navigate a compliance structure built on 3 separate regulatory regimes and over 14 cross-referenced requirements that, together, impose potential penalties of up to RMB 50 million or 5% of annual global revenue. This guide addresses the 4 critical compliance layers—data classification, cross-border transfer rules, consent standards, and local storage obligations—that every foreign health-tech firm, pharmaceutical company, and medical device manufacturer must operationalize before entering or expanding in the Chinese market.

The Three Pillars of Health Data Regulation

China’s health data compliance framework rests on three core laws, each with extraterritorial reach that applies to foreign businesses even if no physical entity exists in the country. The 个人信息保护法 (Personal Information Protection Law, PIPL, gèrén xìnxī bǎohù fǎ) treats health data as “sensitive personal information” and imposes stricter consent, retention, and cross-border transfer obligations than standard personal data. The 数据安全法 (Data Security Law, DSL, shùjù ānquán fǎ) introduces a classification and grading system that can escalate health data to “important data” (重要数据, zhòngyào shùjù) based on volume and public health impact. The 网络安全法 (Cybersecurity Law, CSL, wǎngluò ānquán fǎ) requires Critical Information Infrastructure operators (CIIOs) to locally store all personal and important data collected in China.

In 2022, the National Health Commission added a fourth layer with the 健康医疗大数据标准、安全和服务管理办法 (Health and Medical Big Data Standards, Security and Service Management Measures, jiànkāng yīliáo dà shùjù biāozhǔn ānquán hé fúwù guǎnlǐ bànfǎ), which explicitly applies to foreign entities collecting or analyzing health and medical data from Chinese patients, research subjects, or hospital systems. This measure introduces 5 mandatory compliance domains: data classification, security assessment, local storage, cross-border transfer approval, and audit logging. Unlike the PIPL, which sets a general framework, the Health Data Measures include sector-specific requirements such as mandatory de-identification standards and real-time data breach reporting to the National Health Commission within 2 hours.

The combined effect means a foreign medical device company collecting patient biometric data from a Chinese hospital must comply with PIPL consent rules, DSL classification obligations, CSL local storage rules (if the hospital is a CIIO), and the Health Data Measures’ de-identification and transfer protocols—all simultaneously. Failing to meet any one can trigger a cascading penalty regime where fines under PIPL (up to RMB 50 million) and DSL (up to RMB 5 million) are calculated independently and can be stacked.

Cross-Border Health Data Transfers: The Core Challenge

For foreign businesses, exporting health data out of China is the single most regulated activity. The PIPL mandates one of three transfer mechanisms: a security assessment organized by the Cyberspace Administration of China (CAC), a standard contract (跨境标准合同, kuàjìng biāozhǔn hétóng) filed with the CAC, or certification by a recognized body. Health data, classified as sensitive personal information under PIPL Article 28, triggers the highest threshold: regardless of volume, foreign businesses that process health data of more than 1 million individuals annually must undergo a security assessment rather than using a simple contract. This assessment takes 60–90 business days and requires submission of a data transfer impact assessment, a data mapping report, and a compliance declaration signed by the company’s legal representative.

The DSL adds a second layer for “important data” (重要数据, zhòngyào shùjù) exports, which includes health datasets that could impact national public health security. In practice, this covers aggregated health data from clinical trials with more than 500 participants, genomic data from more than 1,000 individuals, and hospital patient records from tier-3 hospitals. For such data, the security assessment must include a national security review by the CAC, which can take an additional 30–60 days and requires a separate filing with the National Health Commission. Foreign pharmaceutical companies running multi-country clinical trials have reported total approval timelines of 4–8 months for genomic and biomarker data exports.

To illustrate the varying requirements across the three transfer mechanisms, the table below summarizes the key thresholds and timelines foreign businesses must evaluate before choosing a route:

Building Your Compliance Framework: A 5-Step Process

Foreign businesses cannot treat health data compliance as a one-time checklist. Instead, they must operationalize a continuous framework. Step one is data classification and grading (数据分类分级, shùjù fēnlèi fēnjí): audit all health data collected and map it against the 3 classification levels (core, important, general) defined in the DSL and Health Data Measures. General health data (e.g., anonymized step counts) requires basic consent and local storage. Important data (e.g., aggregated hospital records) triggers the full security assessment and national security review. Core data (e.g., national disease surveillance datasets) is effectively prohibited from export and requires Ministry of Public Security approval for any domestic sharing. Step two is local storage infrastructure. All health data classified as important or core must be stored on servers physically located in mainland China. Foreign businesses must either contract with a local cloud provider that holds a Cloud Security Certification (等级保护, děngjí bǎohù) Level 3 or higher, or establish a wholly foreign-owned enterprise (外商独资企业, WFOE, wàishāng dúzī qǐyè) that procures and manages its own servers on Chinese soil.

Step three is consent and transparency (知情同意, zhīqíng tóngyì). Under PIPL Article 29, health data as sensitive personal information requires separate written consent for each processing purpose. That means a single app or device that collects heart rate data for diagnostics, research, and advertising must obtain three distinct consent forms. Consent must be opt-in, not opt-out, and must include a clear description of how the data will be stored, transferred, and deleted. Foreign businesses must ensure their Chinese-language privacy policies specify the full data lifecycle—collection, storage, use, sharing, and deletion—in plain language, not legalese. The Health Data Measures further require that consent forms for clinical trial data include a specific clause authorizing cross-border transfer, and that data subjects be informed of the recipient country’s data protection standards.

Step four is security and breach management. The DSL requires all entities handling important data to designate a Data Security Officer (数据安全负责人, shùjù ānquán fùzé rén) who resides in China and reports directly to the company’s legal representative. This officer must conduct annual security assessments and retain audit logs for at least 6 months. Breach notification is mandatory within 2 hours to the National Health Commission if the breach involves health data of more than 10,000 individuals. Step five is cross-border transfer mechanism implementation. Based on the data classification from step one, foreign businesses must choose among the three transfer mechanisms (security assessment, standard contract, certification) and maintain documentation of the impact assessment for at least 3 years. The combined cost for a full CAC security assessment—including legal consulting, data mapping, translation, and filing fees—typically ranges from RMB 150,000 to RMB 500,000, not including ongoing annual audit costs.

Decision Framework for Compliance Strategy

Choosing the right compliance path depends on your data volume, business model, and risk appetite. If your business processes health data from more than 1 million individuals annually—for example, a global digital health app with millions of Chinese users, or a pharmaceutical company running a nation-wide clinical trial—choose the full CAC security assessment route. This path requires an upfront investment of RMB 300,000–500,000 and a 4–8 month timeline, but provides legal certainty for exporting important data. If your business processes health data from fewer than 1 million individuals annually—for example, a foreign medical device company collecting data from a single hospital network—choose the PIPL standard contract route. This option costs RMB 80,000–150,000 in legal fees and takes 1–3 months to execute, but carries higher regulatory risk because contracts can be challenged by authorities. A third scenario: businesses that collect health data strictly for internal analytics within China—for example, a health insurance provider analyzing claims data—may choose to store all data locally and forgo cross-border transfer entirely. This is the lowest-risk path (zero export-approval cost) but requires a full local server infrastructure with annual costs of RMB 200,000–600,000 for cloud services, plus a Data Security Officer salary.

Common Compliance Pitfalls

Foreign businesses consistently misjudge 3 core requirements, leading to enforcement actions, data blockages, and financial penalties. The first pitfall is underestimating the scope of “health data.” Many companies assume anonymized data is exempt. In China, the Health Data Measures define health data broadly to include any data generated during health services, including device logs, location data from hospital visits, and billing codes. De-identification is not recognized as a complete exemption unless the data is irrevocably stripped of all identifiers and cannot be re-linked to an individual by any means—a standard higher than the EU’s GDPR. The second pitfall is treating consent as a blanket checkbox. Each processing purpose requires separate, specific consent in Chinese. A health app that combines diagnostic, research, and advertising functions must present three separate consent screens; bundling them into one violates PIPL Article 29 and exposes the company to fines of up to RMB 10 million. The third pitfall is ignoring the extraterritorial application of the DSL. Even if your company has no China-based entity, if it collects health data from Chinese individuals—for example, through a wearable device sold globally—the DSL applies. Enforcement actions have already been taken against foreign firms that processed Chinese health data from overseas servers without filing a cross-border transfer assessment.

NEXT STEPS

• Conduct a health data classification audit: Use our Health Data Classification Checklist for Foreign Businesses to map your data against the 3 DSL levels and determine whether you need a CAC security assessment or standard contract. This is your first operational step before any compliance strategy is viable.
• Prepare a cross-border transfer filing package: Download the CAC Security Assessment Filing Template to start compiling your data mapping report, impact assessment, and legal representative declaration. Expect 4–8 weeks for document preparation and another 60–90 business days for approval.
• Establish a China-based data compliance team: If you have not yet designated a Data Security Officer in China, review the Hiring Guide for Data Security Officers in China to understand residency requirements, annual audit obligations, and reporting lines.

— China Gateway 360 —
Remote China market entry support, built around execution.