What Is a Cross-Border Data Transfer?
Foreign brands entering the Chinese market generate huge volumes of data every day: customer profiles on Tmall Global and JD Worldwide, leads from Xiaohongshu and Douyin campaigns, employee records of local staff, and operational metrics shipped to a regional headquarters. The moment that data leaves mainland China, it falls under one of the strictest data export regimes in the world. Under the Personal Information Protection Law (PIPL) and the Data Security Law (DSL), cross-border data transfer is a regulated activity, and non-compliance carries severe penalties. This guide explains, in plain terms, what foreign businesses must do in 2026 to move data out of China legally.
The Three Legal Pathways
China does not ban data exports; it channels them through three approved mechanisms, refined by the 2024 Provisions on Promoting and Regulating Cross-Border Data Flows and fully in force through 2026.
- CAC Security Assessment. Required for large-scale or sensitive transfers, for example when a company handles over one million individuals’ personal information, transfers important data, or operates critical information infrastructure. The Cyberspace Administration of China (CAC) reviews the transfer on security and public-interest grounds.
- Standard Contract. A company may adopt the CAC model Standard Contract, sign it with the overseas recipient, and file it with the CAC. This route suits moderate volumes that fall below the security-assessment threshold.
- Certification. Transfers can be cleared through personal-information-protection certification issued by a CAC-designated professional body, often used within multinational groups.
2026 Thresholds You Must Know
- Transfers involving one million or more individuals’ personal information require a CAC Security Assessment.
- Transfers of 100,000 to one million individuals’ personal information may use the Standard Contract route.
- Any transfer of sensitive personal information above 10,000 individuals needs at least the Standard Contract, and often assessment.
- Important data, as defined by sector regulators, always triggers the Security Assessment.
- Small-volume, necessary transfers, such as internal HR data or limited cross-border e-commerce fulfillment data, may qualify for streamlined or exempt scenarios under the 2024 Provisions.
Steps to Achieve Compliance
- Map your data flows. Inventory what data your WFOE collects, where it is stored, and who outside China can access it.
- Classify the data. Identify personal information, sensitive personal information, and any important data.
- Choose the pathway. Match your volume and sensitivity to assessment, Standard Contract, or certification.
- Prepare documentation. Conduct a personal-information protection impact assessment, draft the Standard Contract or assessment application, and adopt a China-compliant privacy policy.
- File and implement. Submit filings to the CAC and enforce technical safeguards such as encryption, access control, and audit logs.
Penalties for Non-Compliance
Violations can result in warnings, orders to rectify, confiscation of unlawful gains, fines reaching up to fifty million yuan or five percent of the prior year’s turnover, and personal liability for responsible managers. Reputational harm and suspension of data operations are also common consequences.
Practical Tips for Foreign Brands
- Treat data export as a board-level compliance item from day one of market entry.
- Localize data storage where possible; keeping Chinese customer data on mainland servers reduces export volume.
- Build a data inventory before launching cross-border campaigns on Tmall, JD, RED, or Douyin.
- Engage a qualified China privacy advisor early, because the filing process is document-heavy.
Cross-Border Data Transfer and Your Broader China Strategy
Data compliance should not be treated as an isolated legal chore; it is a commercial enabler. Brands that build a clean, documented data-export posture find it far easier to onboard international analytics tools, share campaign insight with offshore teams, and satisfy the due-diligence requests of investors or local partners. Conversely, a single non-compliant feed can trigger regulator scrutiny that spills into customs, platform, and licensing reviews. For a WFOE, the discipline of mapping every flow, classifying every dataset, and choosing the correct pathway becomes part of operational hygiene, much like bookkeeping or tax filing.
The 2024 Provisions deliberately lowered friction for low-risk transfers, signaling that China welcomes compliant business data movement while drawing a firm line around sensitive and large-scale flows. Foreign businesses that engage early, localize storage where sensible, and keep filings current will operate with confidence, while those that improvise risk abrupt disruption. Treat the plan below as a living program, reviewed each time a new system, marketplaces connection, or overseas partner is added.
FAQ
Does my WFOE need to file if we only email monthly reports to HQ?
If those reports contain personal information of Chinese customers or employees above the exempt thresholds, yes. Aggregated, anonymized statistics generally fall outside the rules, but identifiable records do not.
What exactly is important data?
Important data is data whose tampering, leakage, or misuse could harm national security, public health, or economic interests. Sector regulators publish catalogs; when in doubt, assume caution.
How long does a CAC Security Assessment take?
Reviews commonly take several months. A market-entry timeline should budget for this lead time rather than treating it as a formality.
Can we store everything on a global cloud outside China?
Not for regulated data. Chinese personal information and important data generally require mainland storage or a compliant export mechanism before any offshore processing.
What happens if we transfer without compliance?
Regulators can order cessation, levy fines, and hold managers accountable. Non-compliant data flows also jeopardize broader licensing and platform operations in China.