Why It Matters
Two Chinese free trade zones — Shanghai Lingang New Area and Tianjin Free Trade Zone — released separate data transfer frameworks within the same week, marking the most concrete progress on cross-border data liberalization since the State Council’s “Data Security Administrative Measures for Free Trade Zones” took effect in March 2026. For foreign companies operating in China, data compliance has been the single most expensive regulatory challenge since the Personal Information Protection Law (PIPL, 个人信息保护法, gèrén xìnxī bǎohù fǎ) took effect in 2021. As we covered in our Tianjin FTZ data negative list analysis, these zone-level frameworks offer the first practical path to compliant outbound data transfer without case-by-case CAC approval.
Shanghai Lingang published positive whitelists of data categories eligible for export — a “green channel” approach that tells companies exactly what they can send abroad without additional review. Tianjin FTZ took the opposite strategy with China’s first negative list for cross-border data, specifying only what cannot be exported, with everything else presumed permitted. Together, the two models give foreign businesses a regulatory blueprint for operating across China’s growing network of data-pilot zones.
The Details
The Shanghai Lingang whitelist covers the following data categories for export: human resources data (employee names, job titles, work contact information, and salary bands above a threshold of RMB 500,000 annually), cross-border logistics tracking data (shipment status, customs clearance milestones, warehouse inventory counts), and basic financial transaction records for approved FTZ-licensed entities. The whitelist explicitly excludes biometric data, health records, and “important data” as defined by the 2025 Data Security Law implementing regulations. Companies operating in the 120-square-kilometer Lingang area — which now hosts over 400 foreign-invested enterprises — can apply for whitelist certification through the Lingang Administrative Committee’s digital portal, with processing times targeted at 15 working days.
Tianjin FTZ’s negative list approach is arguably more ambitious. The list names three prohibited categories: national security-related data as defined by the NDRC’s classified catalog, personal information of more than 1 million individuals held by any single entity, and strategic technology data (semiconductor manufacturing processes, AI training datasets exceeding 10 terabytes, and pharmaceutical clinical trial data for Class I innovative drugs). Everything else — the negative list explicitly states — does not require additional data export approval during the pilot period running through December 2027. This “everything else is allowed” framing is a significant departure from PIPL’s standard approach, which requires individual user consent for virtually all outbound personal information transfers.
Both frameworks require companies to maintain a data export ledger — a log of all outbound data transfers, their legal basis, the receiving entity, and the data category — subject to annual audit by the local cyberspace administration office. Non-compliance penalties mirror PIPL’s existing regime: fines of up to 5 percent of annual revenue for serious violations, plus potential suspension of data transfer privileges for the offending entity. Foreign companies should also review our broader guide on how China’s cross-border data transfer rules affect foreign businesses, which covers the PIPL compliance obligations that remain in effect outside FTZ pilot zones.
What You Should Do
Determine your zone eligibility. If your China operations are in Shanghai Lingang or Tianjin FTZ, apply for data export certification immediately — the whitelist/negative list frameworks are available to any foreign-invested enterprise registered in the zone. If you operate in Beijing, Suzhou, or Shenzhen, check whether your local FTZ or pilot zone has published a similar framework. Guangzhou Nansha and Hainan Yangpu are expected to follow within 90 days.
Conduct a data classification audit. Map your outbound data flows against both the Shanghai whitelist and Tianjin negative list. Data that falls within the whitelist categories and does not hit the negative list’s prohibited thresholds can be moved without individual consent — a significant operational relief. Budget RMB 80,000–150,000 for the audit, which typically takes 4–6 weeks with a qualified cybersecurity law firm.
Build your data export ledger now. Both zones require an auditable log for compliance reviews. Start with a basic spreadsheet tracking: data category, volume, export frequency, receiving entity (country + organization), legal basis (PIPL Article 38 consent exceptions, whitelist certification, or negative list exemption), and the responsible compliance officer. The ledger format will likely be standardized nationally in 2027 — being ahead of the requirement protects you in case of audit.
One Data Point
The number to remember: two frameworks, one week — Shanghai Lingang’s positive whitelist and Tianjin FTZ’s negative list both launched within seven days of each other. This is the fastest pace of data regulatory reform since PIPL passed in 2021, and it signals that the Cyberspace Administration of China is conceding that the one-size-fits-all approval model is unworkable for the 22 FTZs that now cover most of China’s foreign-invested enterprise base.
— China Gateway 360 —
Remote China market entry support, built around execution.
