Shanghai and Tianjin FTZs Debut Landmark Data Transfer Frameworks, Opening Cross-Border Flows for Foreign Firms
Cross-border data transfer has long been one of the most persistent operational headaches for foreign companies in China. That barrier just got significantly smaller in two of the country’s most important free trade zones. Shanghai’s Lingang New Area and the Tianjin FTZ have simultaneously launched complementary frameworks — a general data whitelist and a negative list for data export — that together provide the clearest regulatory pathway yet for moving business data across China’s borders.
Why It Matters
For foreign-invested enterprises (FIEs) operating in China, data localization requirements have created friction across every function — from global R&D collaboration to supply chain coordination to cross-border payroll processing. The uncertainty around which data could be exported and under what conditions has forced companies to invest in duplicative data infrastructure inside China, sometimes at costs exceeding $500,000 per compliance program.
With Lingang’s general data lists and Tianjin’s negative list now operational, companies in qualifying sectors have something they have not had since China’s Data Security Law took effect: a clear, predictable route for routine data exports. The two frameworks address the same problem from opposite directions — one specifying what can go out freely, the other specifying what cannot — creating a more complete picture for businesses to plan around.
The Details
Shanghai’s Lingang New Area released its first batch of trial general data lists on May 16, 2026, covering three sectors with a significant presence in the zone: intelligent connected vehicles, biopharmaceuticals, and mutual funds. The lists are scenario-based, detailing specific business situations where data export is required and freely permitted — such as multinational production data sharing for connected vehicles, medical clinical trial results for biopharma R&D, and information sharing for fund market research.
Companies registered in the Lingang New Area that need to export data for any purpose covered by the general data lists can do so without undergoing additional compliance procedures normally required by China’s data export security assessment regime. The only carve-out: personal information remains subject to volume-based restrictions. The trial runs for one year from implementation, giving companies a defined window to test the framework.
Tianjin FTZ took a complementary approach, releasing China’s first negative list for cross-border data transfer. Instead of listing permitted data, the negative list specifies the types of data that are restricted from export without certain approval procedures. Combined, the two frameworks let companies assume that any data not on the negative list and meeting the general data criteria can flow freely — a presumption that radically simplifies compliance planning.
The mechanisms differ in scope from the broader CBDT (Cross-Border Data Transfer) rules issued at the national level. While the national framework requires a security assessment for any export of “important data,” the zone-level lists operationalize that vague standard into concrete, sector-specific categories. For automotive companies in Lingang, for example, the list covers production data, vehicle telemetry for overseas R&D centers, and after-sales service data — three categories that cover the majority of routine data needs for a multinational automaker’s China operations.
What You Should Do
If your company operates in the intelligent connected vehicle, biopharmaceutical, or mutual fund sectors and has operations in or near the Lingang New Area or Tianjin FTZ, you should evaluate whether your routine data exports fall within the new frameworks. For Lingang, companies must first register with the Lingang New Area Management Committee — the approved data can then flow freely provided management requirements are met.
For companies in other sectors or zones, these frameworks serve as a template for what is coming. The central government has indicated that similar zone-level data pilots will expand, with at least five more FTZs expected to release their own lists within the next 12 months. Begin mapping your company’s data export categories against the Lingang and Tianjin lists now — even if you are not in those zones, the classification approach will likely become the national standard.
Critical infrastructure operators (CIIOs) in the covered sectors are excluded from the simplified regime and must continue using the national security assessment pathway. If your company operates as a CIIO, plan for the standard timeline of 3-6 months — and review our guide on penalties for non-compliance with China’s cybersecurity rules to ensure your obligations are fully covered.
One Data Point
The number to remember: 12 months — that is the trial period for Lingang’s general data lists, and the window in which companies should test, document, and advocate for expansions to additional data categories. Companies that treat this as a probation period rather than a permanent solution will be best positioned when the framework is renewed or revised.
— China Gateway 360 —
Remote China market entry support, built around execution.
