China Data Localization and Cross-Border Transfer Rules: A Business Guide

Your China team uses a customer database. A colleague in Singapore needs access. Must you move the database to a Chinese server, sign a standard contract, or apply for an assessment?

There is no single answer for every dataset. China does not require every company's data to stay in China. The useful questions are who can access the data, whether it contains personal information or important data, whether the sender is a critical information infrastructure operator, and whether a specific exemption applies. China's 2024 cross-border data rules set out the main decision points.

This guide is for a business planning a real data flow, such as access by a regional headquarters, a foreign cloud provider or an overseas payroll team. It covers the national route first, then explains where Hainan's separate negative list fits.

Does remote access count as sending data out of China?

It can. Keeping a database on a server in China does not, by itself, keep the activity outside the data-export rules. The Cyberspace Administration of China (CAC) says that an overseas person or organisation querying, retrieving, downloading or exporting data stored in China can be an outbound data transfer when the access takes place overseas. An overseas company's employee who is physically in China and accesses the data there, without sending it abroad, is a different case. See the CAC's October 2025 policy Q&A.

So map access as well as file uploads. Ask whether an overseas administrator, support agent, group company or software vendor can view China-based records, including through a shared dashboard.

Is data localization mandatory in China?

For critical information infrastructure operators, the Cybersecurity Law, as revised in 2025, requires personal information and important data collected or produced during operations in China to be stored in China. An outbound transfer needed for business is subject to security assessment under the applicable rules. Article 40 of the Personal Information Protection Law (PIPL) also imposes domestic storage on these operators and on personal-information handlers meeting a quantity set by the CAC, with an assessment route for necessary exports unless an applicable exception says otherwise.

That is not a blanket rule requiring every foreign-owned company to keep every spreadsheet on a Chinese server. The CAC says its national data-export mechanisms focus on personal information and important data; ordinary data that contains neither can generally move across borders, subject to other applicable security and industry rules. See its April 2025 explanation.

Data-export compliance is also a different question from whether a website hosted in mainland China needs an ICP filing or whether an online service needs a telecom licence. Our ICP filing versus licence guide covers that separate decision.

First, identify the data

Before looking at a numerical threshold, separate the proposed transfer into four buckets:

1. Data without personal information or important data. For example, a non-personal inventory summary may fall here. Check that free-text fields and attachments do not quietly contain names or identifiers.
2. Ordinary personal information. Information about an identifiable person needs a lawful processing basis and protection even if the transfer is small.
3. Sensitive personal information. Under PIPL Article 28, this includes financial account, medical, biometric and certain other information, as well as personal information of children under 14. A small sensitive-data transfer can take a different route from an ordinary contact list.
4. Important data. This is a regulatory classification, not just a company's label for commercially valuable files. Under the 2024 rules, Article 2, a handler must identify and report important data under the relevant rules. If the competent authority or region has neither notified the handler nor publicly designated the data as important, the handler need not file an outbound security assessment on the important-data basis. That does not remove any personal-information or industry obligation that also applies.

For personal information, count people, not spreadsheet rows or repeat exports of the same record. The thresholds below run cumulatively from 1 January of the current year. If you cannot tell what a dataset contains, classify the fields before allowing overseas access.

Then check for an exemption

The 2024 provisions, Articles 3–6, exempt specified transfers from the three national export mechanisms: the CAC security assessment, the personal-information standard contract and personal-information protection certification. Relevant examples include:

• International trade, cross-border transport, academic cooperation, multinational manufacturing or marketing data without personal information or important data.
• Personal information collected abroad, sent into China for processing and then sent out again, provided no personal information collected in China or important data is added.
• Personal information that genuinely must be sent abroad to conclude or perform a contract with the individual as a party. Cross-border shopping, payments, flights and hotel bookings are examples in the rule.
• Employee information genuinely needed for cross-border HR management under lawfully adopted employment rules and a lawfully concluded collective contract; urgent transfers to protect life, health or property.
• For a non-critical-infrastructure operator, personal information of fewer than 100,000 people, counted since 1 January, excluding sensitive personal information.
• For a handler within a qualifying free trade zone, data outside the zone's applicable data-export negative list.

The word necessary matters. A company cannot treat every overseas group-company upload as part of a customer's contract. The CAC's October 2025 Q&A says a booking for a domestic hotel is not automatically exempt merely because its overseas headquarters wants the data. The HR exemption likewise depends on a real employment-management need and the specified legal basis, not a general preference to centralise all staff records.

An exemption from those three mechanisms is not an exemption from PIPL notice, a lawful processing basis, a personal-information protection impact assessment or data-security duties where they apply.

If no exemption applies, which route is needed?

The table summarises Articles 7 and 8 of the 2024 provisions. Check the operator and data classification first; the numbers are not an alternative to that step.

The assessment threshold is cumulative. Do not split one flow into smaller batches to make it appear eligible for certification: the CAC expressly warns against this in its September 2026 Q&A. Certification is an operative route under the certification measures in force since January 2026, not a proposed future option. A standard contract is a prescribed contract with the overseas recipient, not just your usual vendor data-processing agreement.

What still applies when the transfer is exempt?

If personal information goes abroad, document why the transfer is needed and limit the fields and recipients to that purpose. PIPL requires a pre-transfer personal-information protection impact assessment and records of the processing; its Articles 55–56 say to retain the assessment report and processing records for at least three years.

Tell individuals about the overseas recipient, its contact details, the purposes and methods of processing, the types of personal information sent and how they can exercise their rights. PIPL Article 39 calls for separate consent, but the CAC's July 2026 clarification explains an important limit: where a non-consent processing basis under PIPL Article 13(1)(2)–(7) applies, individual consent is not required, although the outbound-transfer notice still is. If consent is the applicable basis, obtain separate, specific consent rather than burying it in a general privacy-policy checkbox. Sensitive information brings additional notice and necessity requirements.

These duties are practical, not just paperwork. If the Singapore team needs to resolve ten support tickets, giving it an unrestricted export of the entire China customer history is hard to justify. The CAC's 2026 recruitment example makes the same point: an overseas headquarters that does not take part in a hiring decision has no need to receive every applicant's CV.

Does Hainan's data-export negative list change the answer?

Potentially, for a data handler covered by Hainan's applicable data-export negative list and a transfer outside that list. National Article 6 permits a negative-list route for qualifying free trade zones; Hainan has published its own list, according to the Hainan government. The effect is exemption from the three national export mechanisms for out-of-list data, not permission to ignore PIPL or to assume a sister company elsewhere in China is covered.

Read our Hainan cross-border data negative-list guide for the local scope and the sectors initially covered. This data-export list should not be confused with Hainan's foreign-investment negative list; they answer different questions.

A worksheet before you enable access

Write down one planned transfer, not “all company data”. Record:

1. Sender and recipient: Which China entity controls the data? Who abroad can see it, and from where?
2. Purpose and fields: What task requires access? Which exact fields are necessary?
3. Classification: Is there personal information, sensitive personal information or identified important data? Is the sender a critical information infrastructure operator?
4. Count and exemption: How many people have been covered since 1 January? Does a specific national or Hainan exemption actually fit this flow?
5. Remaining work: Which of the three mechanisms, if any, applies? What notice, lawful basis, impact assessment and access controls are needed?

For example, if a non-critical-infrastructure company lets its Singapore team view ordinary China customer contact information for 12,000 people and no sensitive or important data is involved, the small-volume exemption may remove the three-mechanism step. The company still needs to check the purpose, notice, lawful basis and impact assessment. Add financial account details or expand access to a much larger customer base, and the answer may change.

If you are setting up a Hainan tech business alongside this data flow, our Hainan tech company registration guide covers the entity side. Registering the entity alone does not resolve data-export compliance.

Official sources

• CAC: Provisions on Promoting and Regulating Cross-Border Data Flows (2024)
• National People's Congress text of the Personal Information Protection Law, hosted by the CAC
• CAC: October 2025 data-export policy Q&A
• CAC: July 2026 Q&A on outbound notice and consent
• CAC: September 2026 Q&A on certification and cumulative thresholds
• Hainan government: overview of the Hainan data-export negative list

Read our editorial standards and corrections policy