Overseas headquarters needs information about its China operations to prepare consolidated accounts, plan production, manage suppliers and make investment decisions. Much of this information concerns the business rather than individual employees or customers: inventory figures, production schedules, procurement prices, equipment performance and financial reports.
China does not require every transfer of business data to undergo a security assessment. The starting point is to examine the information itself. Ordinary operational data, personal information and important data usually require different treatment, even when they originate from the same system. Eligible companies should also check whether a free trade zone negative list provides an exemption.
Ordinary operational data
Article 3 of the Provisions on Promoting and Regulating Cross-Border Data Flows exempts data generated in activities such as international trade, cross-border transport, multinational manufacturing and marketing from the security assessment, standard contract and certification requirements where it contains neither personal information nor important data.
Routine reporting may fall within this category. A monthly inventory summary containing product codes, quantities and warehouse totals may qualify. A detailed procurement report containing individual contacts or bank accounts requires further review.
| Information shared with headquarters | Principal review points |
|---|---|
| Inventory and sales summaries | Important-data classification and identifiable customer details |
| Procurement records | Personal information, supplier confidentiality and disclosure restrictions |
| Production and equipment records | Industry classification rules and information revealed by combining records |
| Financial reports | Personal information in supporting schedules and requirements governing underlying records |
| Technical drawings and specifications | Confidentiality, technology export and export-control requirements |
Commercial sensitivity and important data
Commercial sensitivity alone does not make information “important data” under Chinese law.
Article 62 of the Regulations on Network Data Security Management defines important data by reference to particular fields, groups, regions, precision or scale, and the potential for direct harm to national security, economic operations, social stability, public health or safety. Sector-specific examples of important data include geolocation data concerning sensitive areas, vehicle and logistics data reflecting economic activity, and automotive charging network operating data.
Companies should check applicable industry and regional rules. They should also consider the combined dataset: information gathered across facilities or over time may reveal more than individual records.
Article 29 requires identification and reporting of important data in accordance with relevant requirements. Under Article 2 of the cross-border data flow provisions, data that has not been notified or publicly identified as important data need not be submitted for an export security assessment on that basis. Companies must nevertheless follow applicable identification requirements and regulatory notices.
Free trade zone negative lists
Article 6 of the cross-border data flow provisions allows pilot free trade zones to establish negative lists specifying data subject to the security assessment, standard contract or certification requirements. The lists require provincial approval and filing with the national cyberspace and data authorities.
An eligible processor exporting data outside the applicable negative list may be exempt from those three requirements. For a China subsidiary with regular headquarters reporting, the list may provide a more specific basis for assessing covered business scenarios.
The company should first establish that it can use the particular list. A group company’s presence in a free trade zone does not automatically extend eligibility to other subsidiaries. The local rules may also specify covered industries, activities, data categories and procedural conditions.
| Question | What to establish |
|---|---|
| Is the exporting entity eligible? | The geographic and entity requirements under the applicable local rules |
| Is the activity covered? | Whether the industry and actual reporting scenario fall within the list’s scope |
| What does the dataset contain? | Whether its fields and scale meet a listed category or threshold |
| What is the result? | An exemption for qualifying unlisted data, or the applicable requirements for listed data |
A list published in other free trade zone can be a useful reference, but companies should verify its adoption or applicability locally. They should not assume that every published list applies nationwide.
Important data and mixed datasets
Where important data collected or generated in China needs to be provided overseas, a CAC security assessment is generally required, subject to any applicable exemption. A personal information standard contract or certification cannot replace a required assessment.
Important data is not automatically barred from export. Transfers may proceed in accordance with a favourable assessment result and its conditions. If a company is notified that it holds important data, or its data is publicly identified as such, it should apply within two months if it needs to continue the relevant exports.
Operational records frequently contain personal information as well. Production logs may identify operators, and finance schedules may include employee reimbursements. Those fields require the PIPL assessment discussed in the first two articles, taking account of any applicable exemption, including an eligible negative-list arrangement.
Where headquarters only needs totals or trends, a separate report without unnecessary identifiers may be appropriate. Removing names alone may not anonymise a record. Nor does removing personal information resolve a separate important-data issue.
Other restrictions and practical controls
Exemption from an export mechanism does not authorise every disclosure. Article 27 of the Data Security Law requires appropriate security management and technical measures. Contractual restrictions, third-party rights, sector rules and technology export controls may also apply.
Requests connected with foreign proceedings require separate attention. Article 36 restricts providing China-stored data to foreign judicial or law enforcement authorities without approval from the competent Chinese authority.
The subsidiary and headquarters should agree on the reports needed, recipients, level of detail and retention periods. Direct database access should be reviewed separately because it may expose substantially more information than a prepared report.
A practical review follows this sequence:
Define the reporting need → examine the data → check national rules and any applicable negative list → determine the required procedure → configure access and retention.
The assessment should be recorded and revisited when datasets, recipients, systems or applicable lists change.
How our team can help
Our team advises foreign-invested companies on operational data sharing between their China operations and overseas headquarters. We review data classification, important-data requirements, free trade zone negative-list eligibility and sector-specific restrictions, and prepare intra-group sharing arrangements. Where required, we assist with security assessment applications and related compliance work.
Contact the authors
Ziyao Zoey Chen
Scan with WeChat to connect.
On your phone, save or screenshot the code and open it in WeChat.
Yueyi Eve Chen
Scan with WeChat to connect.
On your phone, save or screenshot the code and open it in WeChat.
