China CAC Provisions on Promoting and Regulating Cross-Border Data Flows

Mechanism

China's cross-border data transfer (CBDT) regime, as of the March 2024 Provisions, operates under three legal instruments: (1) the Cybersecurity Law (CSL, 2017), which establishes baseline data-security obligations for all network operators; (2) the Data Security Law (DSL, 2021), which introduces a national-security-anchored classification framework for "important data"; and (3) the Personal Information Protection Law (PIPL, 2021), which governs outbound transfers of personal information. The March 2024 Provisions do not replace these laws; they refine how the three regulatory pathways mandated by Article 38 of the PIPL (CAC security assessment, SCC, or certification) are triggered, and carve out broad categorical exemptions from all three.

Previous baseline (2022 rules): The Measures for Security Assessment of Outbound Data Transfer (effective 1 September 2022) and the Measures for Standard Contract for Outbound Transfer of Personal Information (effective 1 June 2023) established the prior framework. Under those rules, any outbound transfer of personal information by a non-CIIO data processor triggered mandatory SCC filing. The new Provisions raise the threshold to 100,000 cumulative personal-information records (or 10,000 sensitive records) before SCC or CAC security assessment is required, removing the compliance burden for smaller data flows entirely.

Revised threshold structure (non-CIIO data processors):

CIIOs remain subject to CAC security assessment for any outbound transfer of personal information or important data, regardless of volume.

FTZ pilot mechanism: The Provisions empower the central government (via State Council approval) to authorise designated FTZs to issue local negative lists. Any data categories not enumerated on a zone's negative list are treated as freely transferable within that zone. This creates a two-speed compliance environment: FTZ-domiciled enterprises face lighter requirements, incentivising MNC data-processing consolidation within designated zones.

Downstream implications

• Western multinationals: The categorical exemptions for contract performance and

intra-group transfers (below 100K threshold) significantly reduce compliance cost for most operational data flows. MNCs with Chinese operations can restructure shared-services and back-office arrangements without triggering CAC security assessment.

• Cloud and data-centre operators: The transit-data exemption directly benefits global

cloud providers (AWS, Azure, Google) and content-delivery networks routing non-Chinese customer data through Chinese infrastructure nodes.

• Financial services: Cross-border payment, settlement, and correspondent-banking flows

involving personal data (below threshold) benefit from the contract-performance exemption; large retail banks with >1M customer records must still seek CAC assessment.

• FTZ investment: The negative-list pilot creates a regulatory arbitrage between FTZ

and non-FTZ locations; Shanghai Lingang (already designated as a PIPL pilot) is the most advanced zone. Expect incremental FDI into FTZ data-processing facilities.

• Residual regulatory risk: "Important data" remains undefined at the sector level for

most industries (only finance, automotive, and genomics have sector-specific definitions). Until sectoral catalogues are promulgated, non-CIIO processors retain uncertainty about whether specific data sets qualify as important data triggering mandatory CAC assessment.

Open questions

• Sectoral "important data" catalogues remain incomplete; Ministry of Industry and

Information Technology (MIIT) and sector regulators (CBIRC, CSRC, NHSA) have not issued final definitions for most industries.

• How FTZ negative lists will be calibrated in practice — and whether the pilot will

be extended to additional FTZs — remains to be seen.

• Whether the exemption thresholds will be raised further in future amendments if the

compliance-reduction rationale proves insufficient to attract MNC investment.