CAC Shanghai Expands Negative List for Cross-Border Data Transfer Citywide

  Shanghai is further easing restrictions and reducing burdens on enterprises' cross-border data flows.

  Yesterday, the Shanghai Municipal Cyberspace Administration and the Shanghai Municipal Bureau of Data jointly issued a document to officially release the "Administrative Measures (Trial) for the Negative List of Data Export from China (Shanghai) Pilot Free Trade Zone and Lingang New Area, and the National Comprehensive Pilot Area for Expanding the Opening-up of the Service Industry (Shanghai)", taking the lead in expanding the coverage of the negative list from the free trade zone and Lingang New Area to the entire city.

  This policy sets out a scenario-based "negative list" for Shanghai companies' data exports, providing compliance and convenience for foreign-invested enterprises in Shanghai to conduct global collaborative operations and for Shanghai-based enterprises to carry out overseas business, and helping companies to complete cross-border data transfer at a lower cost and in a more convenient way.

  Facilitating R&D for businesses in China

  In the daily operations of enterprises, data involving cross-border transactions can be mainly divided into two categories: one is "important data," which is data that, if tampered with, destroyed, leaked, or illegally obtained or used, may endanger national security, economic operation, social stability, public health and safety; the other is "personal information," which is various types of information related to identifiable natural persons recorded electronically or otherwise, such as consumers' names and mobile phone numbers. This type of information may be involved whether multinational companies are operating in China or domestic companies are expanding overseas, and it is usually in large quantities.

  Previously, companies were required to complete the declaration and approval process for data export whenever the volume of important data or personal information exported reached a certain level. For example, if a company's cumulative cross-border transfer of personal information reached more than 100,000 people in a given year, it was required to file a standard contract for cross-border transfer of personal information with the provincial cyberspace administration department; if the cumulative transfer reached more than 1 million people in a given year, it was required to submit a data export security assessment to both the provincial and national cyberspace administration departments.

  Ren Minmin, Head of Data Compliance for Boehringer Ingelheim Greater China, told reporters that although the "Regulations on Promoting and Regulating Cross-border Data Flows" issued in 2024 has significantly reduced the compliance burden on enterprises, foreign-invested biopharmaceutical companies often have a large volume of personal information leaving the country, and data export security assessments are still required when the volume exceeds a certain level.

  To further reduce the burden on businesses, the Cyberspace Administration of China has begun exploring a negative list regulatory mechanism. Generally, a negative list clarifies the applicable circumstances for relevant scenarios and lists the data that must undergo compliance procedures. In these scenarios, data that does not meet the compliance threshold will be exempt from reporting, significantly simplifying the process.

  Data on the negative list is not prohibited from leaving the country, but must be exported through one of three main compliance paths: data export security assessment, signing a personal information export standard contract, and passing personal information protection certification.

  Meanwhile, the negative list has appropriately relaxed the compliance conditions for data export. Ren Minmin cited an example: the threshold for assessing sensitive personal information in pharmacovigilance scenarios in the biopharmaceutical industry has been raised from 10,000 to 100,000 people, significantly lowering the compliance threshold for companies conducting drug research and development in China. This allows companies to focus more on new drug development and global market expansion. "Now, after applying for pre-review of data export materials at the Zhangjiang local service window, we only need to complete the filing of the personal information export standard contract with the provincial cyberspace administration department to fulfill the data export compliance procedures," said Ren Minmin.

  New Practices of Collaborative Innovation

  The most significant aspect of this new policy lies in its expanded scope, as Shanghai has an urgent need for data export. Statistics show that Shanghai accounts for approximately 40% of the national total in both data export security assessments and standard contract filings for personal information export, ranking first in the country.

  Behind this high demand lies a vast international economic market: Shanghai currently has nearly 80,000 foreign-invested enterprises and approximately 1,700 regional headquarters and R&D centers of multinational corporations. These market entities rely heavily on global data flows for everything from market analysis and product development to customer service. As local enterprises expand overseas, the demand for cross-border data flows is also growing.

  Previously, the negative list facilitation policy only applied to the free trade zone. Many foreign-invested enterprise headquarters, R&D centers, and overseas-bound companies registered in central urban areas like Jing'an and Huangpu, as well as non-free trade zones in Pudong, were unable to enjoy the policy benefits. "Many districts have contacted us to inquire about the possibility of inter-district collaborative innovation to allow companies within their jurisdictions to utilize this policy as quickly as possible," said a relevant official from the Shanghai Municipal Cyberspace Administration. This expansion of the negative list to cover the entire region creates a "fast track" for cross-border data flow, enabling companies to complete data export compliance procedures with lower costs and shorter processing times.

  Therefore, after the state issued a document in 2025 to support pilot demonstration areas for expanding the opening up of the service industry, Shanghai acted quickly and became one of the first regions to apply to expand the policy to the entire city.

  An executive from an international luxury brand located in Jing'an District told reporters that the export of its members' information might have triggered higher-level compliance requirements, but according to the new negative list regulations, the amount of data it generates did not meet the threshold for data export security assessment. In the future, it will only need to complete the filing of the standard contract for personal information export, which will significantly reduce the burden.

  The list will continue to be optimized.

  It is worth noting that the negative list released this time covers four major industry sectors: reinsurance, international shipping, commerce and trade, and meteorology, involving a total of 9 specific scenarios, 29 data subcategories, and 109 data items, which is an expansion compared to the 3 industries and 84 data items released by the Free Trade Zone and Lingang New Area in 2025.

  Why these four industries? The development of international financial, shipping, and trade centers is a crucial component of Shanghai's "Five Centers" initiative, inevitably involving the flow of cross-border data. For example, a reinsurance company expanding its international business will need to frequently exchange underwriting and claims data with its overseas headquarters; a large shipping company managing global vessels and dispatching crews across borders also relies on real-time cross-border data transfer; and a multinational luxury goods company opening a branch in Shanghai will need to synchronize its domestic membership information with its group headquarters.

  In the field of meteorology, observational data from a single country or region is insufficient to support accurate and comprehensive weather forecasts, climate predictions, and disaster warnings. Integrating global meteorological observation data can effectively improve the accuracy and timeliness of weather forecasts and provide more comprehensive meteorological service support for overseas business layouts and cross-border logistics transportation for companies going global.

  Therefore, establishing negative lists for data exports in these four areas is a "must-have" for Shanghai. The cross-border flow of data in these areas is like the flow of blood, and it is the foundation for enterprises to maintain the vitality of their international business.

  The groundbreaking significance of this list lies in its provision of a clear "operating manual" for these high-frequency demand scenarios. On one hand, it clarifies what constitutes important data. For example, in the reinsurance sector, the negative list explicitly states that data related to underwriting and claims settlement that affects national security and economic operations constitutes "important data." On the other hand, the cross-border transfer of personal information can also be subject to "downgraded management." This is like giving foreign companies in the consumer goods sector a "reassurance," significantly reducing their burden of daily cross-border processing of member information.

  It is worth noting that Shanghai can not only use its own regional negative list, but also apply negative lists from other regions. According to the principle of "one region formulates, multiple regions apply" as stipulated by the Cyberspace Administration of China, Shanghai can refer to and implement the official negative lists for data export released by other free trade zones, free trade ports, pioneering zones for reform and opening up, and national comprehensive pilot demonstration areas for expanding the opening up of the service industry.

  The Shanghai Municipal Cyberspace Administration stated that it will continue to conduct research based on industry needs and actively encourage more industry regulatory authorities to participate in the formulation of the negative list. The continuously optimized negative list will become an important support for Shanghai to coordinate data security with high-level opening-up and high-quality development.