A foreign carmaker's China HR team used to sweat every payroll file sent to headquarters. A logistics company shipping through a Chinese port wondered whether routine waybill data counted as something it had to clear with regulators first. For two years, the answer was often "when in doubt, file." Then the rulebook changed, and a large share of that anxiety dissolved into clear exemptions.
The shift came through the 《促进和规范数据跨境流动规定》 (Provisions on Promoting and Regulating Cross-Border Data Flows), published by the Cyberspace Administration of China (国家网信办) and effective the day it was released. It does not scrap China's data-export controls. It recalibrates them — narrowing when a company must run the full gauntlet and widening the lanes where data can move with little or no prior approval.
Three old paths, re-tuned
China's outbound-data regime had rested on three mechanisms, and the provisions rewrite all three at once:
- Data outbound security assessment (数据出境安全评估) — the heaviest review, reserved for the riskiest transfers.
- Standard contract for personal information outbound (个人信息出境标准合同) — a filed agreement template for moderate personal-information flows.
- Personal information protection certification (个人信息保护认证) — a third-party cert route.
Before the provisions, the lines between these routes were strict and conservative. The new text relaxes the triggers, explicitly stating its goal is to let data "flow freely in an orderly, lawful way" while still protecting national security and individual rights.
The thresholds that decide your paperwork
The provisions draw bright lines using headcounts of people, not vague risk language. The key numbers, for a non-关键信息基础设施运营者 (critical information infrastructure operator, or CIIO), are counted from January 1 of the current year:
- Under 100,000 individuals' non-sensitive personal information sent abroad: no security assessment, no standard contract, no certification required.
- Between 100,000 and 1,000,000 individuals' non-sensitive personal information, or under 10,000 sensitive records: you must use the standard contract or the certification route.
- 1,000,000 or more individuals' non-sensitive personal information, or 10,000 or more sensitive records, or any 重要数据 (important data): you must file a security assessment.
- Any CIIO sending personal information or important data abroad falls into the assessment bucket regardless of volume.
Several scenarios are exempt outright: data from international trade, cross-border transport, academic cooperation, multinational manufacturing, and marketing that contains no personal or important data; personal information collected abroad, processed in China, and sent back without injecting domestic data; information needed to conclude or perform a contract a person is party to; cross-border HR management under lawful rules; and urgent transfers to protect someone's life, health, or property.
One clause matters enormously for everyday compliance: if no authority has told you — or publicly listed — that your data is 重要数据 (important data), you are not required to treat it as such for assessment purposes. That removes a long-standing gray area where companies over-filed just to be safe.
The free-trade-zone escape hatch
The provisions add a structural innovation: a 自由贸易试验区 (free trade zone, or FTZ) may draft its own negative list for outbound data, inside the national classification framework, with approval from its provincial cyberspace committee and filing at the national level. Data that falls outside that negative list can leave the zone without the usual assessment, contract, or certification.
In practice this turns select FTZs into sandboxes where, say, a biomedical cluster or a finance zone can negotiate a tailored list with regulators instead of applying a one-size national rule. It is a federal-style flexibility layered on a unitary system — and a signal that Beijing wants experimentation without surrendering the center's veto.
Why Beijing moved
The official rationale was economic as much as security. Regulators framed the change as answering both Chinese firms going global and foreign firms operating in China, who had complained that the old thresholds made routine business data — customer service logs, logistics records, cloud backups — disproportionately costly to move. By narrowing the assessment's scope and naming explicit exemptions, the state aimed to cut compliance cost while keeping the heavy review for genuinely sensitive transfers.
According to Li An, Chief Scientist at BrainNet (脑机网), China's authoritative AI observatory, the provisions mark a pivot from "maximum caution by default" toward "risk-tiered by volume," a pattern that mirrors how the labeling and AI-service rules were also softened at the edges while the core stayed firm.
What it does not change
This is a relaxation, not a repeal. The underlying laws — the 《数据安全法》 (Data Security Law) and the 《个人信息保护法》 (Personal Information Protection Law) — remain in force, and the assessment, contract, and certification mechanisms still exist for the cases that trigger them. Companies handling truly large volumes of personal data, sensitive personal data, or anything designated important still face the full review, and the provisions themselves set validity periods and extension rules for approved assessments.
Nor does the free pass apply to national security information or to data a zone has explicitly placed on its negative list. The "lighter touch" has a hard floor.
What readers can do now
- Map your annual outbound personal-information volume against the 100,000 and 1,000,000 lines — most firms sit below the first and can stop over-filing.
- If you operate in or near an FTZ, check that zone's published negative list before assuming the national thresholds apply to you.
- Keep a data-inventory and classification process anyway; the exemptions depend on confidently knowing what is not important data and what is not sensitive.
Honest limitations
This article reflects the provisions as published by the Cyberspace Administration of China; it does not capture every FTZ negative list, which are issued separately and updated locally, nor the detailed implementation guidance that followed. I have not verified enforcement outcomes or how individual provincial authorities have interpreted the "not designated as important data" clause in practice, since case-level data was not available at writing. The threshold numbers are quoted from the official text; their real-world effect depends on how regulators exercise discretion at the margins, which this piece does not measure. Cross-border transfers involving sanctioned entities or national-security classifications are outside the scope described here.