Can a business in Hainan send customer, research or operations data to an overseas team? There is no useful blanket yes or no. China has national rules for outbound data, and Hainan has published a data-export negative list for the free trade port. The answer depends on the data, the operator and the transfer.
This topic is easy to confuse with Hainan's cross-border bank accounts and money transfers. Those are separate rules. Our Hainan cross-border accounts guide deals with funds; this article deals with data.
What does Hainan's negative list do?
China's 2024 rules allow free trade zones and the Hainan Free Trade Port to formulate data-export negative lists within the national data-classification framework. For a data handler within the relevant zone, a transfer outside the applicable negative list can be exempt from the three national data-export procedures named in the rule: security assessment, standard contract and personal-information protection certification.
Hainan issued its 2024-edition list in February 2025 after the required filing process. An English Hainan government policy overview says the initial list covers five sectors: deep-sea research, aerospace, seed technology, tourism and duty-free retail. The list is a classification and compliance tool, not a general permission to export everything produced in Hainan.
Does data outside the list have no rules?
No. Exemption from those three data-export procedures does not erase the duties to process personal information lawfully, protect data, honour confidentiality obligations or comply with sector-specific rules. Nor does a Hainan registration address the position of an operator or dataset located elsewhere in China. Check the exact operator, location and data flow before applying the Hainan mechanism.
The national 2024 rules also identify cases where a security assessment is required, including outbound provision of important data by certain handlers and threshold-based transfers of personal information. They provide exemptions for some routine trade and other activities under stated conditions. Those national rules and the Hainan list need to be read together, not quoted as competing slogans.
For the national thresholds, exemptions and compliance routes, read our China data transfer guide.
A practical way to assess a transfer
Take one real example: a Hainan company wants its Singapore headquarters to see customer-service records. Before uploading a database, write down:
- Who controls the data? Name the Chinese entity and the overseas recipient.
- What exactly moves? Separate ordinary operational data from personal information, sensitive personal information and any data identified as important.
- Why and how does it move? Record the purpose, fields, access method, destination and retention period.
- Where does the Hainan rule apply? Check the current Hainan list against the actual sector and dataset, rather than relying on the company address alone.
- Which national route remains? Determine whether an exemption or a required assessment, standard contract or certification applies.
Keep a written record of the classification and the reason for the chosen route. If the dataset, destination or use changes, repeat the check. For higher-risk data, ask a qualified data-protection adviser to examine the source rules and the current version of the list.
This question often appears when a foreign-owned company opens an office and wants to connect it to overseas systems. Our Hainan tech company registration guide covers the entity side. It does not replace a data-flow assessment.
Official references
- Cyberspace Administration of China: 2024 cross-border data flow rules
- Hainan authorities' notice and negative-list attachment, hosted by the Fujian Department of Commerce
- Hainan government: overview of the 2024-edition list and five sectors
- Cyberspace Administration of China: implementation update
Read our editorial standards and corrections policy
Thanks for your feedback.
