EV in China Update: New Data Security Rules for Connected EVs — Key Takeaways

Key Takeaways from the New Data Security Rules

The regulations build on China’s broader data security framework—including the Data Security Law (数据安全法, shùjù ānquán fǎ) and the Personal Information Protection Law (个人信息保护法, gèrén xìnxī bǎohù fǎ)—but introduce automotive-specific requirements that are more stringent than general data rules. Here are the three critical takeaways every foreign EV executive must understand.

1. Data Localization is Now Mandatory for All Vehicle-Generated Data
   All data collected by connected EVs—including location data, driving behavior, sensor data, and vehicle status—must be stored on servers physically located in China. Foreign companies can no longer rely on pre-2024 arrangements that allowed data to be stored overseas with self-assessed security measures. The rule applies retroactively to data collected since 2021, meaning existing data streams must be migrated to local servers by March 31, 2025. Companies using cloud services from providers like AWS, Azure, or Alibaba Cloud must ensure that data never leaves Chinese jurisdiction, even during processing.
2. Cross-Border Data Transfers Require CAC Approval
   Any transfer of vehicle-generated data outside China—even for engineering, quality analysis, or software updates—requires prior approval from the CAC. The approval process includes a data security impact assessment, a cross-border transfer contract, and a designated legal representative within China who bears personal liability. In 2023, the CAC approved only 68 cross-border transfer applications out of 215 submitted, a 32% approval rate. Foreign companies should expect a minimum 6-month review period for initial applications.
3. Real-Time Monitoring and Annual Audits Are Required
   Companies must deploy real-time data monitoring systems that provide China authorities with continuous access to data processing logs. Additionally, an independent third-party audit must be conducted annually, with results submitted to the MIIT and CAC within 60 days of the fiscal year-end. The first audit deadline is June 30, 2025, for data collected in 2024. Non-compliance with monitoring requirements can trigger immediate suspension of vehicle sales permits.

Comparison: Old Rules (2021–2023) vs. New Rules (2024)

The following table summarizes the key regulatory changes that directly affect foreign EV manufacturers and their supply chains in China.

Compliance Checklist for Foreign Automakers

Use the following checklist to assess your current readiness against the new data security rules. Each item represents a regulatory requirement with a defined deadline.

• Data localization audit – Identify all vehicle-generated data currently stored outside China and create a migration plan. Deadline: December 31, 2024 for mapping data; March 31, 2025 for all other data.
• CAC cross-border transfer application – Submit for approval if any data must leave China (e.g., for overseas R&D). Application must be submitted by February 28, 2025 to allow for 6-month review.
• Real-time monitoring system deployment – Install certified monitoring software that logs all data access, processing, and transfer activities. System must be operational by April 1, 2025.
• Appoint a China-based data security officer – Designate a senior executive with legal liability for compliance. This person must be a Chinese national or permanent resident. Deadline: Within 60 days of the rule effective date (November 30, 2024).
• Conduct a data security impact assessment – For each data category collected from connected EVs. Must be completed before any cross-border transfer application.
• Engage a qualified third-party auditor – Select an approved auditing firm from the MIIT’s published list. Audit must be completed by June 30, 2025.
• Update privacy policies and user consent mechanisms – Ensure in-vehicle and app-based disclosures comply with the new rules, including specific consent for data localization. Deadline: November 30, 2024.

Pitfalls to Avoid

Implementation Timeline and Key Dates

Foreign auto executives should mark these dates in their compliance calendars. Missing any of these deadlines could trigger automatic review by regulators.

• October 1, 2024 – Rules take effect. All new EVs sold from this date must comply with real-time monitoring requirements.
• November 30, 2024 – Deadline to appoint a data security officer and update user privacy policies.
• December 31, 2024 – Deadline to localize all mapping and high-precision location data (critical for autonomous driving features).
• February 28, 2025 – Final submission date for CAC cross-border transfer applications to allow for 6-month review before the next deadline.
• March 31, 2025 – Final deadline for migrating all vehicle-generated data to servers in China.
• April 1, 2025 – Real-time monitoring systems must be operational and connected to regulatory platforms.
• June 30, 2025 – First annual third-party audit report must be submitted to MIIT and CAC.

Compared to the European Union’s GDPR automotive guidelines—which allow for cross-border transfers under standard contractual clauses—China’s new rules are significantly more restrictive. The EU’s approach permits data transfer with adequate safeguards, while China requires prior government approval for any outbound flow. Similarly, the United States has no federal data localization requirement for connected vehicles, though California’s privacy rules impose consent obligations. China’s framework is currently the most stringent among major EV markets, and foreign automakers must adapt accordingly.

Management and Implementation Framework

Work on china data-security rules for connected electric vehicles should begin with a documented business objective, not a form or provider quotation. The team should identify the China activity, responsible entity, location, expected start date, transaction or employee population and internal risk tolerance. These facts determine which approvals, records and controls are proportionate.

Sequence the implementation

A practical sequence moves from fact confirmation to option selection, document preparation, authority or counterparty review, implementation and post-launch verification. Dependencies should be visible. No team should assume that registration, a signed contract or a successful system submission proves operational readiness; bank, tax, HR, finance and local operating steps often have separate completion evidence.

Control ownership and evidence

Implementation quality is visible in the evidence trail left behind. For china data-security rules for connected electric vehicles, the accountable group normally includes the China automotive lead, homologation or regulatory owner, product engineering and commercial strategy team. Responsibility should be divided between preparation, approval and independent checking. The core file should contain vehicle and component approvals, technical specifications, test results, data-flow records, supplier evidence and market-release decisions. Evidence should be dated, attributable to a named owner and linked to the decision or filing it supports. Verbal confirmation is not a substitute for a retained authority notice, counterparty response or approved internal record.

The control calendar should reflect the product planning, regulatory assessment, testing, launch and post-market monitoring. Dependencies and cut-off dates need to be visible to every function that supplies data. Any external provider should receive a written scope, required inputs, response timetable and escalation route. The company remains responsible for reviewing outputs even when execution is outsourced. Known failure modes include approval delay, connected-vehicle data exposure, battery or software change, supplier dependency and pricing assumptions that ignore policy change; each should have a preventive check and a named reviewer.

Management review and escalation

Progress reporting should distinguish submitted, accepted, activated and independently verified. The status pack should show the decision required, facts confirmed, assumptions still open, monetary or operational exposure, next deadline and responsible owner. Items that depend on local discretion should be labelled clearly. Escalation should occur when an authority rejects a filing, a counterparty requests materially different evidence, a cost or timing threshold is exceeded, or actual operations no longer match the approved setup.

Before go-live, the responsible executive should confirm that legal form, contracts, system configuration, payment authority and record retention are aligned. A short post-implementation review after the first operating cycle should compare planned and actual time, cost and exceptions. That review is where recurring controls are corrected and where lessons become part of the company standard rather than remaining with an individual adviser.

Practical completion checklist

• State the business decision, scope, city, entity and target date.
• Confirm the current official rule and any local implementation requirement.
• Assign preparation, approval and independent review to named owners.
• Retain the documents, calculations and correspondence supporting the decision.
• Test cost, timing and operational assumptions against a downside case.
• Record unresolved issues and the threshold for management escalation.
• Verify the first completed operating cycle and update the control calendar.

Execution Record and Handover

The final record for china data-security rules for connected electric vehicles should allow another manager to understand what was decided, which evidence was relied on and which obligations remain open. The handover pack should identify the current operating assumption, the approving executive, the external authority or counterparty involved, the effective date and the next mandatory review. It should also explain any local interpretation, exception or temporary workaround so that it is not mistaken for a permanent rule.

For ev, continuity depends on preserving vehicle and component approvals, technical specifications, test results, data-flow records, supplier evidence and market-release decisions. Files should use a consistent naming convention and access should follow the company’s authority matrix. Critical dates belong in a controlled calendar rather than an individual’s inbox. Where a provider holds original submissions or account credentials, the contract and exit plan should guarantee prompt return of records in a usable format.

A quarterly control check should sample one completed transaction or employee cycle, reconcile it to the approved process and record exceptions. Material deviations should be assigned to an owner with a due date; repeated deviations should trigger a process redesign rather than another informal reminder. This creates a defensible link between policy, daily execution and management oversight while keeping the control proportionate to the actual China operation.

Official Sources

• Cyberspace Administration of China: Personal Information Protection Law
• Cyberspace Administration of China: official policy and regulatory portal
• National Information Security Standardization Technical Committee