--- title: "A gate, not a wall: China's draft rules for automotive data leaving the country" date: 2026-11-11 category: Policy & Governance site: NeuroAI canonical: https://neuroai.site/a/na-policy-automotive-data-export-draft language: en --- # A gate, not a wall: China's draft rules for automotive data leaving the country > Eight Chinese regulators published a draft guide for automotive data exports in June 2025; it is a draft for comment, not yet in force, and sets clear thresholds and exempt paths for carmakers going global. A Chinese automaker testing its driver-assistance stack in Germany wants to send training clips home. A supplier needs to ship a control program's source code to a parent company abroad. Each transfer is now a question with no clean answer. A June 2025 draft from eight regulators tries to give that answer — but it is still a draft, and the gate is not yet installed. ## Key takeaways - Eight ministries and agencies — led by the Ministry of Industry and Information Technology (MIIT) and the Cyberspace Administration of China (CAC, 国家网信办) — published the *Automotive Data Export Security Guide (2025 Edition)* as a draft for comment (征求意见稿) on 13 June 2025. - The comment window closed on 13 July 2025. As reviewed here, the text is a draft for comment and has **not** been finalized into a binding normative document (规范性文件); it should not be treated as in force. - It sets three export paths: a security assessment for the riskiest flows, a standard contract or certification for mid-size personal-information flows, and nine exemption scenarios. - Thresholds that trigger a mandatory assessment: exporting important data, or cumulatively 1,000,000 or more individuals' personal information (non-sensitive) from 1 January in a year, or 10,000 or more individuals' sensitive personal information. - It names the automotive-data handlers broadly — manufacturers, parts and software suppliers, telecom operators, autonomous-driving service providers, platforms, dealers, repairers, and mobility operators — and details important data by business scenario. ## Why a sector-specific rule China already has a general data-export framework under the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, and the Network Data Security Management Regulation. A 2021 trial automotive-data measure introduced principles like "process inside the vehicle." Yet companies kept hitting the same wall: the general rules were clear in spirit but thin on what an automaker actually moves. The 2025 draft narrows that gap for a sector where cross-border flows are routine — global R&D, overseas production, and autonomous-driving validation all pull data across borders. The drafting bodies, working under the national data-security coordination mechanism, say the aim is an "efficient, convenient, and secure" export mechanism rather than a blanket block. ## The three export behaviors The draft first defines what counts as an export at all, and it is wider than "send a file abroad": - Data collected and generated in domestic operations is transmitted to a location outside China. - Data stored inside China is queried, retrieved, downloaded, or exported by an overseas party. - Personal-information processing about domestic individuals happens outside China under the Personal Information Protection Law's extraterritorial reach. That second behavior is the quiet trap: data that never leaves a Chinese server can still be an "export" the moment a foreign colleague pulls it. ## The three paths **Path one — security assessment (申报数据出境安全评估).** Mandatory when any of these hold: the data is "important data"; or from 1 January in a year the handler has cumulatively provided 1,000,000 or more individuals' personal information excluding sensitive data; or 10,000 or more individuals' sensitive personal information; or the handler is a critical information infrastructure operator providing personal information. **Path two — standard contract or certification.** For handlers that are not critical-infrastructure operators: cumulatively 100,000 or more but under 1,000,000 individuals' non-sensitive personal information, or under 10,000 individuals' sensitive personal information, can use either a personal-information export standard contract or certification. **Path three — nine exemptions.** These skip the assessment, contract, and certification entirely: data collected abroad and returned after processing with no domestic personal information or important data introduced; cross-border car purchases, parcel delivery, or payments; cross-border human-resources management under lawful rules; emergency protection of life, health, or property; small flows under 100,000 individuals' non-sensitive, non-important personal information; free-trade-zone negative-list carve-outs; security-vulnerability data already reported to MIIT; security-incident data already reported to regulators; and OTA upgrade source code already filed with the market regulator for a recall. ## Important data, by scenario The draft's most detailed contribution is a scenario-by-scenario catalog of "important data" that would force an assessment. Five core scenarios anchor it: - **Research and development:** bills of materials, design documents, product and development source code. - **Manufacturing:** process bills of materials and production-control program source code. - **Driving automation:** algorithms, training data, and feature data for assisted or autonomous driving. - **Software upgrade services:** source code for power, chassis, and safety-driving software packages. - **Networked operation:** vehicle identifiers, in-vehicle keys and digital certificates, control commands, roadside perception data, and autonomous-driving map data. An industry body, CATARC (中汽中心), later tallied the important-data provisions as 27 categories across the scenarios. The draft pairs each item with a judgment rule, nudging identification toward measurable tests. ## The stage, stated plainly This is the part most often misreported. The text published on 13 June 2025 is a **draft for comment (征求意见稿)**. It says it "intends to be issued as a normative document." The comment deadline was 13 July 2025. In the sources reviewed for this article, it had not been finalized into a binding rule. Anyone describing it as "China's new automotive data-export law now in force" would be wrong. The correct framing is: proposed and consulted, not yet effective — a design to prepare for, not a constraint currently in force. ## Honest limitations This article is based on the June 2025 draft-for-comment text and contemporaneous official and industry reporting; because the document is a draft, its thresholds, scenarios, and exemptions may change before any final issuance, and the status described here reflects sources available at writing. The 27-category tally is a third-party (CATARC) analysis, not the draft's own wording, and should be reconfirmed against the finalized text. This piece covers the automotive-specific draft only and does not restate the broader data-export framework in full. Readers must verify the current stage on MIIT and CAC channels, since a finalized version may have appeared after the sources used here. No financial figures are involved. ## What readers can do now - **Run a data-inventory sweep against the five scenarios.** Even though the draft is not in force, its scenario catalog is a ready-made checklist for tagging important data in R&D, manufacturing, driving automation, upgrades, and networked operation. - **Separate your three paths now.** Map each cross-border flow to assessment, contract/certification, or exemption so you know which transfers would survive a finalized rule. - **Watch MIIT and CAC for the finalized text.** The draft's comment window has closed; track the issuing agencies for the binding version and any shifted thresholds before planning overseas data architecture. --- Published by NeuroAI (https://neuroai.site/) — https://neuroai.site/a/na-policy-automotive-data-export-draft Free to quote with attribution and a link to the original.