A human-resources team in Shanghai needs to sync employee records with a regional office in Singapore. A logistics firm ships order data to a warehouse system in Germany. For years, both faced the same anxious question: does this transfer need Beijing's sign-off, and how long will that take?
What changed and why
On 22 March 2024, the Cyberspace Administration of China published the Provisions on Promoting and Regulating Cross-Border Data Flows (《促进和规范数据跨境流动规定》, CAC Order No. 16). The provisions took effect the same day they were published. They adjust three existing mechanisms — the data-export security assessment, the standard contract for personal-information export, and personal-information protection certification — by narrowing what must be reviewed and widening what is exempt.
The stated aim is to let data move where the risk is low, while keeping the gate for data that matters to security (数据安全) and to individuals. The practical effect for a company is that a routine transfer — say, syncing a marketing list that holds no personal details — no longer waits on a multi-month security assessment, which had been the default fear. Instead the question becomes narrower: does this specific transfer fall in an exempt lane, or does it touch data that still needs the gate. The provisions reframe compliance from "assume you must file" to "confirm you are exempt," shifting the burden of the first guess and letting ordinary business flows proceed unless something flags them.
The free-pass list
The provisions list transfers that need no security assessment, no standard contract, and no certification:
- Data generated in international trade, cross-border transport, academic cooperation, multinational manufacturing, and marketing that contains no personal information or important data.
- Personal information collected overseas, processed in China, and sent back out, with no domestic personal information or important data introduced during processing.
- Information needed to conclude or perform a contract with an individual — cross-border shopping, shipping, remittances, payments, bookings, visas, exam services.
- Employee personal information transferred for cross-border human-resources management under lawful rules and collective contracts.
- Data sent abroad in emergencies to protect a person's life, health, or property.
- For processors other than critical-information-infrastructure operators, cumulative exports below 100,000 individuals' personal information (non-sensitive) since 1 January of the year.
The contract-performance exemption is broad by design: the everyday acts of cross-border shopping, shipping a parcel, sending a remittance, paying a supplier, booking a hotel, or handling a visa all count as concluding or performing a contract with an individual, so the data they require can move without a separate filing. The employee-information carve-out lets a company move staff records for legitimate human-resources management — the Shanghai-to-Singapore payroll sync that opened this article — without treating routine HR data as a security event.
The red lines that remain
Not everything is freed. The provisions keep firm gates on two fronts:
- Critical-information-infrastructure operators must still declare a security assessment when exporting personal information or important data.
- Other processors must declare an assessment when exporting important data, or when cumulative exports reach 1,000,000 individuals' personal information (non-sensitive) or 10,000 individuals' sensitive personal information in a year.
For a critical-information-infrastructure operator, the rule is blunt: any export of personal information or important data triggers a security assessment, with no small-volume escape. For everyone else, the cliff edges are the scale thresholds — the 1,000,000-person and 10,000-sensitive-person lines — which turn a gradual accumulation of exports into a sudden obligation the moment the count is crossed in a year. The point is not to frighten routine business but to keep the genuinely large or sensitive flows visible to regulators, while the smaller lanes move without friction.
The penalties for mishandling personal information are not trivial. Under the Personal Information Protection Law, serious violations can draw fines of up to RMB 50,000,000 (about US$7.0 million / HK$54.5 million), or 5% of the prior year's turnover.
The free-trade-zone experiment
A notable feature is the free-trade-zone negative-list system. Within the national data classification framework, a free-trade zone may draw its own negative list of data that still requires assessment, contract, or certification. Once approved by the provincial cybersecurity and informatization committee and filed with national authorities, data outside that list can move freely. This turns pilot zones into testing grounds for a more granular, place-based approach to data security (数据安全). A company inside such a zone gains a local map: instead of guessing against the national list, it reads the zone's own negative list to see which data still needs a gate, and everything outside that list flows.
Why it matters
Why it matters is straightforward: data that moves freely is data that supports business, and the provisions let low-risk flows proceed without the delay that once chilled cross-border operations. At the same time, the red lines protect the categories that genuinely bear on national security (数据安全) and on individual rights under the Personal Information Protection Law, the PIPL. The balance is the story — easier on the everyday, firmer on the sensitive — and a company that reads the two halves together avoids both over-filing routine transfers and under-protecting the data that still needs a gate. The framework's foundation in the Cybersecurity Law, the Data Security Law, and the PIPL means the exemptions are lanes within a settled structure, not a suspension of it.
Key takeaways
- The 2024 provisions are in force, not a draft — effective 22 March 2024.
- Routine, low-risk transfers are exempt; sensitive and large-scale personal-data exports still need review.
- Free-trade zones can set local negative lists, adding flexibility.
- The framework sits on the Cybersecurity Law, Data Security Law, and PIPL.
What readers can do now
- In-house counsel: map each cross-border transfer to the exemption list before assuming a filing is needed.
- Compliance teams: track your year-to-date personal-information export count against the 1,000,000 / 10,000 thresholds.
- Zone operators: check whether your free-trade zone has published a negative list and what it covers.
- Data owners: keep a running log of each transfer's legal basis — exempt lane, contract need, or assessment — so a year-end tally is a lookup, not a reconstruction.
- Finance and HR teams: confirm that your employee-record transfers match the lawful HR-management carve-out and that no domestic personal information is pulled in during China processing, which would break the exemption.
- Zone tenants: if you operate in a free-trade zone, request the approved negative list from your local authority and map your data categories against it on a regular basis so a new list does not catch you out.
Honest limitations
This article summarizes the provisions as published; it is not legal advice. Threshold figures (100,000; 1,000,000; 10,000) are statutory numbers in the text, but their application depends on how "important data" and "sensitive personal information" are interpreted in practice. Negative lists differ by zone and can be updated, so readers should confirm the current list with the relevant free-trade-zone authority and the CAC.