China: Shanghai Pilot Free Trade Zone’s Lingang New Area: Released Measures for Cross-Border Data Transfer Classification and Graded Management

Authors: Carol Zhu and Lynsey Liu

In November 2023, the State Council issued the Overall Plan for Fully Embracing International High-standard Trade and Economic Rules to Promote the High-level Opening-up of the China (Shanghai) Pilot Free Trade Zone (the “Plan”). The Plan supports the Shanghai Pilot Free Trade Zone in taking the lead to explore the establishment of a legitimate, secure, and convenient mechanism for cross-border data transfer. It aims to promote more convenient, secure, and efficient cross-border data transfer for businesses.

During the International Data Economy Industry Innovation Conference on 19 January 2024, the Measures for Classification and Graded Management of Cross-Border Data Transfer in the Lingang New Area (Trial Implementation) (the “Measures“) were released. The Measures classify cross-border data into three levels: core data, important data, and general data, with core data being strictly prohibited from cross-border transfer. Important data can undergo initial verification by the Lingang New Area Cross-Border Data Service Center and can then be submitted to the Municipal Committee’s Office of Cyberspace Affairs for data export security assessment. General data, on the other hand, can be freely transferred as long as it meets the relevant management requirements. Additionally, important data and general data will be separately compiled into catalogs and lists.

This year, the Lingang New Area will take the lead in organizing working groups consisting of industry-leading enterprises and experts focusing on specific scenarios within key areas such as intelligent connected vehicles, financial management, high-end shipping, international trade, biopharmaceuticals, and cultural exports. With extensive research to identify the specific details of data export, a series of general data lists and important data catalogs will be gradually released.

Key Action Points

According to the Personal Information Protection Law of the People’s Republic of China (“China”), if a personal information processor needs to provide personal information to entities outside China, they should undergo a security assessment organized by the national cyberspace administration, obtain personal information protection certification, or enter into standard contracts with the overseas recipients.

Against this regulatory backdrop, in order to ensure both security and convenience in cross-border data transfer, the Shanghai Pilot Free Trade Zone in China is conducting experiments and explorations that are beneficial to multinational enterprises registered within the Lingang New Area.