China’s updated Cross-Border Data Transfer (CBDT, 跨境数据传输规则, kuàjìng shùjù chuánshū guīzé) regulations took full effect for newly registered foreign-invested enterprises on July 1, 2026, introducing a tiered compliance framework that varies by data volume, industry, and zone. Under the new rules, a standard WFOE (Wholly Foreign-Owned Enterprise, 外商独资企业) handling fewer than 10,000 individual data subjects’ personal information per year can transfer data cross-border without a security assessment — a significant simplification from the 2024 regime that required assessments for any non-exempt transfer.
Why This Matters
For foreign companies registering a WFOE in 2026, data transfer compliance is no longer a post-registration afterthought — it is a registration-stage requirement. The new rules, jointly issued by the Cyberspace Administration of China (CAC, 国家互联网信息办公室) and MOFCOM in March 2026, require new WFOE applicants to declare their expected data transfer volume and category as part of the business license application in 12 pilot cities, including Shanghai, Beijing, Shenzhen, and Guangzhou.
This shift catches many new entrants off guard. In Q1 2026, before the rules took effect, approximately 34% of new WFOE applications in Shanghai were returned for additional data-transfer documentation, according to Shanghai AMR process data shared with registered agents. By Q3 2026, that figure is expected to normalize at 15-20% as the requirement becomes standard knowledge — but for now, it remains the single most common reason for application delays.
The stakes are real. Under Article 38 of the 2026 CBDT implementing regulations, a WFOE that transfers personal information across borders without the required filing faces fines of up to 5% of its annual China revenue or RMB 50 million — whichever is higher. For a newly registered entity with zero revenue in the first year, the regulator applies a minimum fine of RMB 10,000-100,000, plus a mandatory compliance rectification order within 30 days.
The Details
The tiered framework. The 2026 CBDT rules establish three compliance tiers for new WFOEs. Tier 1 (exempt): fewer than 10,000 data subjects’ personal information transferred annually, no sensitive personal information, and data used only for HR administration or internal business operations. No security assessment, no standard contract — just a simple annual filing with the local CAC office. Tier 2 (standard contract): 10,000 to 1 million data subjects, or any volume involving sensitive personal information (health data, financial records, biometric data). Requires a CAC-standard personal information export contract signed with the data recipient, plus a legally mandated privacy impact assessment. Tier 3 (security assessment): over 1 million data subjects, or data classified as “important data” under Chinese law (defined by sector-specific catalogues). Requires a full CAC security assessment — a process that takes 45-60 working days and requires a designated China-based data protection officer.
Zone-specific exemptions. WFOEs registered in Shanghai’s Lingang FTZ, Hainan Free Trade Port, and Beijing’s Zhongguancun Science Park qualify for additional liberalization. The Lingang data whitelist (launched June 2026) allows qualifying manufacturers and R&D service firms to transfer production and quality data without any assessment — provided the data is non-personal and categorized on the whitelist. The Hainan FTP offers a similar “data transfer green lane” for encouraged-industry enterprises. For the broader CBDT framework applicable to all zones, see our full WFOE registration guide.
What newly registered WFOEs typically send. Based on CAC compliance filings from Q1-Q2 2026, the most common data categories transferred by new service-sector WFOEs are: employee HR data (100% of filers), client contact information for service delivery (72%), financial reporting data for parent company consolidation (58%), and software usage analytics (34%). Most consulting and IT-service WFOEs fall under Tier 1 — the exempt category — because they transfer primarily employee data and operate below the 10,000-subject threshold. A three-person consulting WFOE in Shanghai with no Chinese clients and two locally hired employees transferring their payroll and benefits data to the Singapore regional HQ: that is an exempt Tier 1 transfer.
The registration-stage requirement. Since July 2026, new WFOE applications in the 12 pilot cities include a CBDT declaration form (Form CB-1). The form asks for: estimated annual data subject count, categories of data transferred, destinations (countries/regions), and the intended compliance mechanism (exempt, standard contract, or pending assessment). The form is reviewed alongside the business scope and Articles of Association. If the declared data volume exceeds Tier 1 thresholds, the registration approval includes a condition: “CBDT compliance must be completed within 90 days of business license issuance.” This means the WFOE’s registration is approved, but its data transfers are not legal until the contract is signed or the assessment is complete.
What You Should Do
- Classify your data before registering. Before filing your WFOE application, audit what data your China entity will transfer: employee data, client data, operational data, or product data. Count the data subjects. If you stay under 10,000, you are exempt — declare Tier 1 on Form CB-1 and move forward. If you cross the threshold, budget for a standard contract (RMB 20,000-50,000 in legal fees) or a security assessment (RMB 80,000-150,000 in consulting fees, 45-60 days).
- Check your zone’s exemptions. If your WFOE qualifies for Lingang’s whitelist or Hainan’s green lane, your compliance burden drops substantially. Lingang’s whitelist covers production and R&D data for manufacturing and biopharma entities; Hainan’s green lane covers encouraged-service industries. For a location-specific analysis, see our city comparison for company registration.
- Appoint a data protection officer now. Even if your WFOE is Tier 1 (exempt), appoint a person responsible for data compliance — it is a regulatory expectation under Article 54 of the 2026 rules. This can be the general manager. The requirement: a named individual who can confirm, within 48 hours of a CAC request, what data the entity transfers and under which mechanism.
- Budget for the standard contract if you grow. If your WFOE expects to cross 10,000 data subjects within 12 months — e.g., a SaaS company onboarding Chinese clients — execute the standard contract proactively before hitting the threshold. The CAC allows pre-emptive compliance filing, and doing so avoids the 30-day gap between crossing the threshold and having the contract in place.
Where to Go From Here
Based on what you just read, here is your recommended next step:
- If you are ready to register a WFOE and need the full process: Read our 7-Step WFOE Registration Guide.
- If you are still deciding which data tier applies: Compare remote WFOE registration FAQs.
- If you need a quick cost estimate for compliance: Try our company registration cost FAQ.
One Data Point
The number to remember: 10,000 — the data-subject threshold below which your new WFOE can transfer cross-border data without a security assessment or standard contract under the 2026 CBDT rules. A typical consulting or IT-service WFOE with fewer than 10 employees and no Chinese client data operations falls under this threshold and needs only an annual one-page filing. If your data volume stays under 10,000, data compliance costs approximately RMB 5,000-15,000 per year for the filing and data protection officer appointment. If it crosses 10,000, costs jump to RMB 50,000-200,000.
— China Gateway 360 —
Remote China market entry support, built around execution.
