How to Leverage China’s FTZ Data Negative Lists to Streamline Data Export 

China’s free trade zones have introduced data export negative lists that can simplify cross-border data transfers for companies in covered industries. This article explains how data export negative lists work across the FTZs and how companies can assess eligibility and prepare to use them.

Since 2024, China has been piloting a data negative list system in its free trade zones (FTZs) to ease cross-border data transfer requirements for companies operating in strategically important industries. The initiative has since expanded to nine FTZs, each with its own list identifying the types of data and business scenarios that remain subject to statutory data export compliance procedures, and allowing data outside the lists to be transferred overseas through a simplified process. 

However, with rules and scope varying between FTZs, determining whether a company can benefit from the lists can be complicated, requiring careful review of the applicable negative list, its affiliated implementation regulations, and data classification guidelines. This article explains how the lists work and offers practical guidance to help companies assess eligibility and navigate the requirements. 

How can companies benefit from the FTZ data export negative lists? 

Under national CBDT rules, companies in China that export certain types or volumes of data must complete one of three different compliance procedures: an export security assessment by the Cybersecurity Administration of China (CAC), receiving a personal information export security certification by a third-party agency, or signing a standard contract with the overseas recipient of the data.

Which procedure applies depends on different factors, including the specific type of data (such as “important” or “general” data) involved, the volume of personal information (in cases involving the personal data collected from people in China), and the status of the company itself (whether or not it is considered a critical information infrastructure operator (CIIO)). 

The FTZ negative lists, along with their accompanying implementation guidelines, help to simplify these procedures by outlining the types of data that are subject to which compliance procedure, and, by extension, exempting data not included in the lists from these compliance obligations altogether. 

What data is covered by the negative lists? 

In all cases except Tianjin, the negative lists apply to a specific, narrow scope of industries and fields, meaning only companies operating in one of these industries or fields can use them to facilitate data export. In Tianjin’s case, the negative list is based solely on different data categories and volumes of personal information, rather than specific industries and fields. 

While the data negative lists originally applied only within the FTZs themselves, Beijing and Shanghai have expanded the program to their respective “Pilot Regions for the Comprehensive Opening-Up of the Service Sector”, which cover all of both cities’ districts. 

The data included under each industry or field is divided into two broad categories – “important” data and personal information. Important data is then broken down into different operational and business scenarios. 

The data negative lists applicable in the Guangdong FTZ (which also covers the Shenzhen Park of the Hetao Shenzhen-Hong Kong Science and Technology Innovation Cooperation Zone (Hetao Shenzhen Park)) and Shanghai also include parity clauses, meaning data negative lists from all other FTZs are also applicable in these zones. 

What data can be freely exported? 

In principle, any data exported by a company operating within an industry or field covered by a negative list that is not included in the list can be exported without the statutory compliance procedures.  

However, it is important to carefully review each negative list to establish what that data actually entails. The data categories under each industry are usually scenario-based, encompassing data involved in a particular business or operational process, rather than specific types of data (although they do provide non-exhaustive examples of data types). 

For personal information, the negative lists are based on the volume of data being exported, not type, with each industry category outlining data volume thresholds that, if reached, trigger the corresponding compliance procedures. Only volumes that fall below these thresholds can be freely exported. 

Moreover, while companies don’t need to undergo one of the three compliance procedures to export exempted data, they still need to submit an application or file with the FTZ, in line with each FTZ’s implementation guidelines. This is a quicker and more straightforward process than the data export compliance procedures – but it is not entirely frictionless. 

Preparing for data export under the negative lists 

Carry out data classification to assess eligibility 

Before commencing data export procedures, companies need to identify and determine the type and volume of data being transferred overseas to assess whether it falls within the scope of the applicable negative list.

Six of the nine FTZs have released accompanying data classification guidelines outlining the criteria for identifying important data or large volumes of personal data that may trigger a security assessment by the CAC – the highest compliance bar for data exports. 

Assessing eligibility therefore requires companies to first classify their data, then compare the relevant data types, volumes, and proposed export scenarios against the negative list, including any specified personal information thresholds. Data classification alone does not determine eligibility, and the company must establish whether its data operations fall within the scenarios and conditions covered by the list. 

The FTZ regulations also provide that where an industry authority has already issued standards or specifications for classifying important data, these take precedence over the classification guidelines published alongside the negative list. 

Check the rules for the specific FTZ

Companies should be aware that the rules and implementation procedures differ between FTZs. This means verifying which negative list applies to their operations, whether their proposed exports fall within its scope, and what local requirements apply, which may be more complex for conglomerates within multiple China entities in different FTZs. The negative list regulations also have differences in reporting and filing procedures, required supporting documents, and rules for how particular data categories are defined and classified. 

Retain records and ensure ongoing compliance 

Exporting data that is exempt from compliance procedures under a negative list does not exempt companies from their broader data protection obligations. Companies must continue to fulfil their data security protection obligations and implement technical and other necessary measures to safeguard cross-border data transfers. It is also important to maintain data classification records and eligibility assessments. FTZ regulations stress that if a cross-border data security incident occurs or the risk to data export security increases, companies must take remedial measures and promptly report the matter to the provincial-level competent department and the relevant regional management authority. 

How Dezan Shira & Associates can help 

Dezan Shira & Associates helps businesses navigate China’s evolving cross-border data regulations, including FTZ data negative lists. Our legal and compliance experts can help companies assess eligibility, interpret data classification requirements, identify applicable filing and compliance obligations, and develop practical strategies to streamline data transfers while managing regulatory risks. Contact us to discuss how your business can benefit from China’s FTZ data negative lists. 

FAQs 

What are the data negative lists in China’s FTZs? 

China’s FTZs have established localised data export regimes based on “negative lists” that define categories of data that remain subject to strict cross-border transfer procedures, thereby allowing all other data (within the specified industries or fields) to be transferred overseas with greater ease. 

Which FTZs have issued data negative lists? 

Currently, nine of China’s 23 FTZs have issued data negative lists. These are, broadly, the FTZs in Beijing, Shanghai, Hainan, Guangdong, Jiangsu, Chongqing, Tianjin, Fujian, Guangxi, and Zhejiang, though some apply to areas beyond the FTZs themselves. 

Can data outside the data negative lists be freely exported? 

Not exactly. Whether data is exempt from statutory data export compliance procedures depends on the applicable national rules, including the type and volume of data being transferred. To export exempted data, companies must also still apply or file with the local FTZ authorities before commencing the cross-border data transfer. 

What if the data my company needs to export is on the negative list? 

If the data earmarked for export is on an applicable data negative list, then you must undergo one of the data export compliance procedures before transferring it abroad. The applicable procedure will depend on the type and volume of the data involved. 

What if my company is in an industry not covered by a negative list? 

If a company is operating within an industry that is not covered by an applicable data negative list, then the national standards and regulations for data export apply. 

What if my company is not located in an FTZ? 

The FTZ data negative lists only apply to companies that are registered within one of the FTZs that have commenced data negative list pilot programs; companies outside of these areas must adhere to national standards and regulations for data export.