Background: BritStyle’s CAC Data Security Assessment Journey

Background: BritStyle’s CAC Data Security Assessment Journey

BritStyle Ltd., a London-based e-commerce company specializing in premium British consumer goods with annual revenues of £215 million in 2024 and 650 employees, set its sights on the Chinese market through cross-border e-commerce. The company launched a Tmall Global flagship store in March 2024, followed by a JD Worldwide store in June 2024. By December 2024, the company had accumulated data on approximately 380,000 Chinese customers — including names, addresses, phone numbers, payment information, and browsing behavior data — triggering an obligation under China’s data security framework that would test the organization’s compliance capabilities.

China Gateway 360 delivers Remote China market entry support, built around execution — and this case study examines how BritStyle successfully passed the Cyberspace Administration of China (CAC) Data Security Assessment, a prerequisite for cross-border e-commerce platforms handling significant volumes of Chinese consumer data.

According to a 2025 report by the China E-Commerce Research Center, 62% of cross-border e-commerce companies operating on Tmall Global and JD Worldwide collect sufficient Chinese customer data within their first 12 months to trigger CAC assessment obligations. Yet only 34% of those companies pass their first assessment attempt. BritStyle’s experience offers a replicable model for British and European e-commerce brands navigating China’s data security requirements.

China’s Data Security Assessment Regime for E-Commerce

The CAC Data Security Assessment is governed by the Measures for Security Assessment of Outbound Data Transfers, effective September 1, 2022. For cross-border e-commerce platforms, the key triggers for mandatory assessment include processing personal information of more than 1 million individuals annually, transferring important data (as defined by the Data Security Law), or operating as a Critical Information Infrastructure (CII) operator in the e-commerce sector.

For cross-border e-commerce, the CAC assessment evaluates data categories collected (including whether sensitive personal information is involved), the necessity and proportionality of data collection relative to the service provided, technical security measures protecting data during cross-border transmission, the legal basis for processing (consent, contract performance, etc.), and the data governance framework of the recipient entity outside China. BritStyle’s data profile — 380,000 customers with payment and address data — placed the company above the mandatory assessment threshold, triggering the formal CAC process.

Navigating the CAC Assessment: BritStyle’s Strategy

BritStyle adopted a structured approach to the CAC assessment, organized around five workstreams executed over a 19-week period from January to May 2025.

Workstream 1: Comprehensive Data Audit and Classification

BritStyle’s data engineering team, supported by external consultants from PwC China, conducted a full audit of all customer data collected through the Tmall Global and JD Worldwide stores. The audit identified 156 discrete data fields across 8 data categories: customer identity data (name, ID number, passport information), contact data (phone, email, shipping address), financial data (payment instrument tokens, transaction history), behavioral data (browsing history, purchase patterns, product preferences), communication data (customer service chat logs, email correspondence), logistics data (tracking numbers, delivery status, return requests), marketing data (email opt-in status, promotional engagement metrics), and technical data (IP addresses, device fingerprints, cookie identifiers). Of these, 43 fields were classified as sensitive personal information under PIPL — primarily financial data and precise location data for delivery — requiring heightened protection measures and explicit, separate consent.

Workstream 2: Legal Basis and Consent Framework

One of the most challenging aspects of the CAC assessment was demonstrating that BritStyle had a valid legal basis for collecting and transferring each data category. For cross-border e-commerce, PIPL Article 13 provides several legal bases, of which BritStyle relied primarily on contract necessity (processing data necessary to fulfill product purchase and delivery) and consent (for marketing, personalization, and analytics). The company redesigned its Tmall Global checkout flow to present granular consent options, including: mandatory consent for transaction processing (contract necessity), opt-in consent for cross-border data transfer (PIPL Article 39 requirement), opt-in consent for personalized product recommendations, and opt-in consent for sharing data with third-party logistics providers outside China. The consent redesign took 4 weeks and involved coordination with Alibaba’s Tmall platform team, as all frontend modifications had to comply with Tmall’s store design guidelines.

Workstream 3: Technical Security Controls

BritStyle implemented a comprehensive technical security framework to satisfy the CAC’s technical review requirements. The company established a China-specific data architecture: customer data collected through Tmall Global was routed to an Alibaba Cloud Shanghai instance, with only necessary and lawfully transferred data flows transmitted to BritStyle’s UK-based ERP and analytics systems. All cross-border data transfers were encrypted using TLS 1.3 in transit and AES-256 at rest. BritStyle also deployed a data access monitoring system that logged every outbound data transfer — including purpose, requesting system, data category, and approval timestamp — to provide an auditable trail for the CAC review. The technical implementation cost approximately £180,000 and was completed in 8 weeks.

Workstream 4: Data Protection Impact Assessment

A Personal Information Protection Impact Assessment (PIPIA) was required under PIPL Article 55 for the cross-border transfer of personal information. BritStyle engaged KPMG China to conduct the PIPIA, which covered: a systematic description of the data processing operations and their purposes, an assessment of the necessity and proportionality of processing relative to the purposes, an evaluation of risks to data subjects’ rights and interests, and the technical and organizational measures proposed to address those risks. The PIPIA report — 147 pages in its final version — identified 31 risk items, of which 26 were remediated before the CAC submission (primarily data retention period documentation gaps and consent interface improvements), and 5 were accepted as residual risks with documented mitigation plans.

Workstream 5: CAC Submission and Response Process

BritStyle submitted its CAC assessment application to the Shanghai Municipal CAC office in March 2025, accompanied by the PIPIA report, data flow diagrams, consent interface screenshots, technical security documentation, and the proposed standard contractual clauses with the UK data recipient entity. The CAC’s technical review raised 17 follow-up questions over a 6-week period, covering data retention periods for customer accounts inactive for more than 12 months, procedures for responding to data subject access requests, third-party data processor management, cross-border data transfer volume projections, and incident response procedures. BritStyle responded to each question within 5 business days on average, with detailed technical explanations and supporting documentation.

Key Challenges and Mitigation

BritStyle encountered several significant obstacles during the CAC assessment process:

Challenge 1: Categorization of Transaction Log Data. The CAC technical review team questioned whether BritStyle’s detailed transaction logs — which recorded product views, search queries, and purchase abandonment data — constituted “behavioral profiling data” under PIPL’s sensitive personal information classification. If classified as sensitive, the data would require additional consent and impact assessment. BritStyle’s legal team, working with Shanghai-based data privacy counsel, prepared a detailed legal memorandum arguing that anonymized, aggregated transaction logs without individual identifiers did not meet PIPL’s definition of behavioral profiling. The CAC accepted this position after 2 weeks of review, but the uncertainty added 3 weeks to the assessment timeline.

Challenge 2: Third-Party Logistics Data Sharing. BritStyle used a cross-border logistics provider that required access to customer shipping data — including names, addresses, and phone numbers — for customs clearance and last-mile delivery. Under PIPL, sharing personal information with third parties requires separate consent. BritStyle’s initial implementation obtained consent through a general privacy policy statement rather than a specific opt-in, which the CAC flagged as insufficient. The fix required 3 weeks of platform redesign work to implement separate logistics data sharing consent toggles, integrated with the checkout flow on both Tmall Global and JD Worldwide.

Challenge 3: Data Retention Period Definition. The CAC requested specific, documented retention periods for each data category, with justifications linked to legal or business requirements. BritStyle had previously operated a single “retain as long as account is active” policy, which the CAC deemed insufficiently specific. The company developed a comprehensive data retention schedule: transaction data retained for 5 years (to satisfy Chinese tax and accounting law requirements), customer service chat logs retained for 3 years, browsing behavior data anonymized after 12 months, and inactive customer accounts flagged for data deletion after 24 months of inactivity. The retention schedule development took 3 weeks of work across legal, compliance, and product teams.

Challenge 4: Cross-Border Data Transfer Documentation for Alibaba’s Platform. BritStyle’s Tmall Global and JD Worldwide store data was hosted on Alibaba Cloud, and the company needed to demonstrate that its contractual arrangements with Alibaba Group met PIPL’s requirements for third-party data processor management. The Alibaba Cloud Data Processing Addendum — which had been updated for PIPL compliance — required 4 weeks of review between BritStyle’s UK legal team and Alibaba’s China legal team, primarily around liability caps, audit rights, and data deletion procedures upon contract termination.

Lessons for Foreign Investors

BritStyle’s successful CAC Data Security Assessment offers several generalizable lessons for British and European e-commerce brands entering China:

1. Start the assessment process earlier than you think necessary. BritStyle began data mapping in the same month it launched on Tmall Global, recognizing that customer data would accumulate rapidly. Most e-commerce companies wait until they approach the 1-million data subject threshold before starting, but the 4–6 month assessment timeline means that delaying puts your cross-border data transfers at risk. BritStyle’s early start meant the assessment was completed before any regulatory deadline pressure.
2. Invest in China-dedicated technical data architecture from day one. BritStyle’s decision to route all Chinese customer data to an Alibaba Cloud Shanghai instance — rather than processing it through the UK-based infrastructure — saved approximately 8 weeks of remediation work that would have been required to retrofit data localization onto an existing global architecture. The upfront investment of £180,000 was significantly less than the estimated £350,000 in remediation costs and lost sales from delayed market entry.
3. Budget for the CAC assessment’s follow-up question cycle. BritStyle spent approximately £45,000 responding to the CAC’s 17 follow-up questions — hiring specialist legal counsel for technical responses, allocating engineering time for supplementary documentation, and engaging KPMG for additional PIPIA analysis. First-time applicants typically receive 10–25 follow-up questions, and companies should budget £30,000–£60,000 for this phase alone.
4. Design consent architecture for China’s platform-specific constraints. Implementing granular consent toggles within Tmall Global’s store design framework required significant engineering coordination with Alibaba’s platform team. BritStyle recommends starting this conversation 8 weeks before the intended consent redesign launch, as platform approval cycles can be slow.
5. Maintain a continuous data inventory, not a one-time exercise. The CAC expects data flow documentation to be maintained dynamically — new product launches, marketing campaigns, and logistics arrangements can change data categories and volumes. BritStyle implemented a quarterly data inventory refresh cycle, which reduced the burden of annual re-assessment preparation.
6. Document your data retention schedule with reference to Chinese law. The CAC responded positively to BritStyle’s retention schedule because each period was tied to a specific Chinese legal requirement (tax law, e-commerce law, consumer protection law). Retention periods justified by “business convenience” or “industry practice” are more likely to be challenged.

Where to Go From Here

BritStyle received formal CAC approval for its cross-border data transfers in May 2025 — the first British e-commerce brand to pass the assessment on its initial submission. The company’s Tmall Global and JD Worldwide stores continue to operate with full regulatory compliance, and BritStyle reports that the CAC compliance framework has become a competitive differentiator in customer trust surveys.

For British and European e-commerce brands at an earlier stage of their China data compliance journey, the following resources can help accelerate the process:

• CAC Data Security Assessment preparation guide for e-commerce — a step-by-step walkthrough covering data audit methodologies, documentation templates, consent architecture design, and submission procedures.
• Cross-border e-commerce data compliance checklist for Tmall Global and JD Worldwide — platform-specific requirements for data collection, consent management, third-party sharing, and technical security controls.
• PIPIA template and methodology guide for cross-border e-commerce — a customizable impact assessment framework designed for the specific data processing patterns of international online retail.

How a British E-Commerce Brand Passed a CAC Data Security Assessment: Case Study — first published on China Gateway 360. Last updated: July 2026.