China Cross-Border Data Update: CAC Publishes 2026 Data Export Compliance Guidelines — Key Takeaways

The Cyberspace Administration of China (CAC, 国家互联网信息办公室, guójiā hùliánwǎng xìnxī bàngōngshì) has published its 2026 Data Export Compliance Guidelines (数据出境合规指南, shùjù chūjìng hégūi zhǐnán), a 48-article document that introduces 5 structural changes to China’s cross-border data transfer framework, effective April 1, 2026. The new guidelines replace the 2022 Data Export Security Assessment Measures and the 2023 Standard Contract for Cross-Border Personal Information Transfer (个人信息出境标准合同, gèrén xìnxī chūjìng biāozhǔn hétóng), consolidating them into a single, tiered compliance system that reduces mandatory security assessment obligations for an estimated 70% of foreign-invested enterprises (外资企业, wàizī qǐyè).

This update is significant because it marks the first major regulatory recalibration since the CAC’s 2024 interim liberalization measures, and it directly affects any company with China-based operations that transmits employee, customer, or operational data across borders — including HR systems, cloud migration, and global ERP implementations. Below we break down the structural changes, compliance tiers, and practical consequences for foreign executives.

1. The New Compliance Tier System — Three Paths Instead of Four

Under the 2022 framework, companies faced four separate compliance pathways: Data Export Security Assessment (数据出境安全评估, shùjù chūjìng ānquán pínggū) for important data or large volumes, Standard Contract filing for smaller volumes, Personal Information Protection Certification (个人信息保护认证, gèrén xìnxī bǎohù rènzhèng), and an exemption for truly de-identified data. The 2026 Guidelines collapse these into three defined tiers:

• Tier 1 — Security Assessment: Required only when (a) the data contains national-security-relevant “important data” (重要数据, zhòngyào shùjù) as defined by sectoral catalogues, or (b) the enterprise transfers the personal information of more than 5 million individuals annually. Down from the previous threshold of 1 million.
• Tier 2 — Standard Contract Filing: Applies to enterprises transferring personal information of between 100,000 and 5 million individuals annually, or any volume of non-sensitive personal information used for routine HR and operational purposes.
• Tier 3 — Exemption with Filing (免备案, miǎn bèi’àn): Covers transfers of fewer than 100,000 individuals’ data per year, all de-identified data, and data transferred under specific international judicial assistance treaties or bilateral agreements.

For foreign executives, the most impactful change is the 400% increase in the security assessment threshold. In practice, this means that a typical multinational with 200,000 employees in China and standard operational data flows will no longer need a full security assessment — it can instead use the Standard Contract pathway, which typically reduces compliance lead time from 6–9 months to 4–8 weeks.

2. Expanded Exemptions for “Routine Business Operations”

The 2026 Guidelines introduce a new category of exempted transfers under the label “routine business operations” (常规业务操作, chángguī yèwù cāozuò). This covers five specific scenarios:

1. Global HR administration: Payroll, benefits, performance management data sent to headquarters or regional shared-service centers.
2. Cross-border IT support: Log data, access records, and incident tickets transferred to global security operations centers.
3. Supply chain management: Purchase orders, shipping manifests, and quality-control data shared with overseas suppliers.
4. Financial reporting: Consolidated revenue, audit trails, and tax filings sent to parent companies or external auditors.
5. Product liability and recall: Customer safety data transferred for regulatory compliance in export markets.

Each of these scenarios still requires a written data protection impact assessment (DPIA, 数据保护影响评估, shùjù bǎohù yǐngxiǎng pínggū) to be filed with the local CAC office within 30 days of the first transfer under the exemption. However, no prior approval is needed — a shift from the “pre-approval” model of the 2022 measures. The CAC expects that approximately 60% of cross-border data transfers by foreign-invested enterprises will qualify for this exemption, compared to an estimated 30% under the prior framework.

3. Timeline and Transition Period — What Foreign Companies Must Do Now

The 2026 Guidelines become effective on April 1, 2026. The CAC has provided a 9-month transition period until December 31, 2026 during which existing security assessments and standard contract filings remain valid. Key milestones are:

• April 1, 2026: New compliance tier system takes effect. Companies commencing new data transfers after this date must use the new framework.
• July 1, 2026: Deadline for companies currently undergoing a security assessment to re-evaluate under the new thresholds. Companies falling below the 5-million-individual threshold may downgrade to Tier 2 (Standard Contract) without restarting the process.
• December 31, 2026: All existing security assessments and standard contract filings must be renewed or migrated to the new framework. After this date, any assessment or filing issued under the 2022 framework is void.
• From January 1, 2027: Full enforcement begins, with fines for non-compliance of up to 50 million RMB or 5% of annual revenue for serious violations — unchanged from the Personal Information Protection Law (个人信息保护法, gèrén xìnxī bǎohù fǎ), but now applied to a broader range of oversight scenarios.

Foreign-invested enterprises should treat the period from now until July 2026 as a “compliance audit window” — the opportunity to reclassify data flows under the new tiers and reduce administrative burden before full enforcement begins.

Key Risk Areas and Compliance Traps

Decision Framework: Choosing Your Compliance Path

If your company transfers more than 5 million individuals’ personal information annually or any volume of sector-defined important data, choose Tier 1 — Security Assessment. Start the application process now, as the CAC’s review cycle can take 45–60 working days.

If your company transfers between 100,000 and 5 million individuals’ data annually, and the data does not contain sector-specific important data, choose Tier 2 — Standard Contract Filing. This path requires no pre-approval, only post-signing filing within 30 days.

If your company transfers fewer than 100,000 individuals’ data annually, or falls into one of the 5 routine business operation scenarios, choose Tier 3 — Exemption with Filing. Complete a DPIA and file it within 30 days of the first transfer.

NEXT STEPS

1. Conduct a data flow audit: Map all cross-border data transfers by category, volume, and sensitivity against the new 2026 tiers. Use our cross-border data audit checklist to ensure completeness before the July 1 re-evaluation deadline.
2. Update your Standard Contract template: The 2026 Guidelines introduce minor revisions to the mandatory clauses of the Standard Contract, including a new provision on government access requests. Download the updated 2026 Standard Contract template and replace your existing version.
3. Register for the DPIA pre-filing window: The CAC has opened a voluntary pre-filing window from now until March 31, 2026 for companies to submit draft DPIAs for non-binding review. Submit your DPIA early via the CAC’s pre-filing portal to identify issues before the deadline.

— China Gateway 360 —
Remote China market entry support, built around execution.