Data Localization Update: Autonomous Driving Data Must Stay in China — Key Takeaways
As of October 2024, China’s revised Data Security Law mandates that all data collected by autonomous driving systems must be stored and processed within China’s borders — impacting over 200 global automakers and tech firms with autonomous driving operations in the country. This update tightens earlier 2021 rules on 数据本地化 (data localization, shùjù běndìhuà) and introduces binding requirements for 自动驾驶数据 (Autonomous Driving Data, zìdòng jiàshǐ shùjù) handling, with non-compliance administrative fines reaching up to 50 million RMB under the 网络安全审查 (cybersecurity review, wǎngluò ānquán shěnchá) regime. Foreign executives now face a compressed timeline: existing data infrastructure must be re-audited by April 2025 or risk losing operational licenses.
By early 2023, China had already collected over 300 million kilometers of autonomous driving test data from domestic test fleets. By contrast, foreign automakers had been cross‑shipping driving data to headquarters in Germany, Japan and the U.S. Since 2021, at least 14 major foreign automakers have set up local data centers in China, but the new rules require full separation — no data sharing with parent companies unless it passes a 网络安全审查 (cybersecurity review, wǎngluò ānquán shěnchá).
What the New Regulation Requires for Autonomous Driving Data
The revised rules classify 自动驾驶数据 (Autonomous Driving Data, zìdòng jiàshǐ shùjù) into seven categories: high‑definition mapping, vehicle trajectory, sensor raw feeds, driver behavior logs, passenger identification, traffic environment reconstruction, and over‑the‑air update logs. All seven categories must now be stored exclusively on domestic servers, with no cross‑border transmission except under explicit government exemption. This represents a hardening from the 2021 version, which allowed cross‑border transfer after a risk assessment. The 2024 standard requires real‑time data audit trails to be accessible by the 国家网信办 (Cyberspace Administration of China, CAC, guójiā wǎngxìn bàn) within 48 hours of a request.
For foreign automakers, this means any autonomous driving test fleet operating in China must have its own in‑country data warehouse — or use a CAC‑approved cloud provider. At present, only three domestic cloud providers (Alibaba Cloud, Huawei Cloud, and Tencent Cloud) hold CAC certification for autonomous driving data storage. The regulation also forbids any 自动驾驶数据 (Autonomous Driving Data, zìdòng jiàshǐ shùjù) from being used to train AI models outside China, even in aggregated or anonymized form. This directly affects global R&D pipelines: a German automaker that previously used Chinese driving scenarios to refine its Level 4 algorithms in Munich must now duplicate that training infrastructure inside China.
Operational Complexity for Foreign Automakers with 自动驾驶数据 (Autonomous Driving Data)
The operational burden falls hardest on firms that have already invested in hybrid data architectures — those that store data locally but ship derived model weights or aggregated logs abroad. The 2024 update closes that loophole: any output derived from 自动驾驶数据 (Autonomous Driving Data, zìdòng jiàshǐ shùjù) that retains original geographic or behavioral signatures is now treated as the data itself. For example, a simulated driving scenario reconstructed from real Beijing traffic flows — even if heavily modified — counts as local data and cannot leave China. This parallels the 2022 automotive data security trial requirement but extends it from test fleets to production vehicles. Over 80% of foreign automakers surveyed by the China Automotive Technology and Research Center in Q1 2024 reported needing to rebuild at least part of their data pipeline to comply, with estimated costs of 8–15 million RMB per brand for infrastructure upgrades.
Staffing is another constraint. The regulation mandates that data compliance officers for 自动驾驶数据 (Autonomous Driving Data, zìdòng jiàshǐ shùjù) must be based in China and be Chinese nationals. Foreign nationals can advise but cannot hold signing authority for data security filings. This creates a direct recruitment challenge: the CAC estimates only 2,800 certified data compliance professionals exist nationwide, while demand from automotive firms alone exceeds 10,000. Foreign automakers are now competing with 百度 (Baidu, Bǎidù), 华为 (Huawei, Huáwéi), and 小鹏 (XPeng, Xiǎopéng) for a shrinking talent pool, pushing monthly salaries for senior compliance officers above 80,000 RMB.
Timeline and Enforcement Risks: What Changed from 2021 to 2024
The original 2021 Data Security Law required a general risk assessment for cross‑border data transfers but left autonomous driving data in a gray zone. The 2024 update specifies autonomous driving as a “critical information infrastructure” domain, triggering stricter obligations under the 网络安全法 (Cybersecurity Law, wǎngluò ānquán fǎ) and the 数据安全法 (Data Security Law, shùjù ānquán fǎ). The table below highlights the key shifts:
| Requirement | 2021 Rules | 2024 Update |
|---|---|---|
| Data storage location | Recommended domestic storage; cross‑border allowed after risk assessment | Mandatory domestic storage for all seven categories of 自动驾驶数据 (Autonomous Driving Data, zìdòng jiàshǐ shùjù) |
| Cross‑border transmission | Permitted after self‑assessment and filing | Banned except by explicit CAC exemption; no self‑assessment option |
| Training of foreign AI models | Allowed if data was aggregated and anonymized | Forbidden if any original geographic or behavioral signature remains |
| Compliance officer nationality | No restriction | Must be Chinese national based in China |
| Audit timeline | Annual self‑report | Real‑time audit trails, accessible by CAC within 48 hours |
| Maximum fine for non‑compliance | Up to 5 million RMB | Up to 50 million RMB (10‑fold increase) |
The enforcement timeline is equally aggressive. Firms already collecting 自动驾驶数据 (Autonomous Driving Data, zìdòng jiàshǐ shùjù) must submit a compliance plan by January 2025 and achieve full compliance by April 2025. New entrants must achieve compliance before starting data collection. The CAC has signaled it will conduct spot audits starting March 2025, with a penalty phase beginning immediately after. Foreign automakers that fail to comply face not only fines but also suspension of 自动驾驶测试 (autonomous driving testing, zìdòng jiàshǐ cèshì) licenses. In a worst‑case scenario, vehicles already sold could be remotely restricted from activating autonomous features — a move that would trigger massive warranty and liability issues.
Key Stats and Implications for Foreign Automakers
Beyond the regulatory text, the numbers paint a stark picture. By Q3 2024, the CAC had approved only 12 cross‑border data transfer exemptions for autonomous driving — out of 237 applications. That approval rate of 5.1% underscores the practical barrier. Meanwhile, China’s domestic autonomous driving data market is projected to reach 48 billion RMB by 2026, up from 12 billion RMB in 2023, according to the China Academy of Information and Communications Technology. Foreign automakers collectively account for roughly 35% of that current data volume, but under the new rules they must invest in domestic storage and processing — essentially creating a parallel data ecosystem inside China. The operational cost premium is estimated at 12–18% of autonomous driving R&D budgets for foreign firms, compared to 4–6% for domestic rivals.
Timeline pressure also intersects with the 2025 expiration of tax incentives for joint‑venture electric vehicle production. Several foreign automakers are now weighing whether to accelerate or cancel autonomous driving rollout plans in China. At least two European OEMs have privately indicated they may delay Level 4 launches by 12–18 months to rebuild their data infrastructure. For foreign executives, the decision to comply is not optional — but the pace and approach are still negotiable through a 网络安全审查 (cybersecurity review, wǎngluò ānquán shěnchá) filing. Engaging a CAC‑registered consultant early can reduce the compliance timeline from 8 months to 5 months on average, according to market intelligence from Inkwood Research.
NEXT STEPS
- Audit your current data flows. Use our Data Compliance Audit Checklist to identify which of the seven categories of 自动驾驶数据 (Autonomous Driving Data, zìdòng jiàshǐ shùjù) you are collecting and where it is stored today.
- Select a CAC‑approved cloud provider. Review our comparison of Top Cloud Providers for Autonomous Driving Data in China to align with Alibaba Cloud, Huawei Cloud, or Tencent Cloud.
- Retain a CAC‑registered data compliance officer. If you lack an in‑house Chinese national with data security credentials, use our Compliance Officer Hiring Guide to source qualified talent within 60 days.
— China Gateway 360 —
Remote China market entry support, built around execution.
