The following guest article was submitted by Mikheil Shengelia, Research Analyst at Eagle Alpha, an alternative data aggregation platform providing supporting advisory services for data buyers and vendors.
On July 9th, Eagle Alpha held a webinar with AnJie Broad Law Firm discussing the latest developments in China’s data export regime — covering which data categories remain subject to strict controls, where requirements have eased, and how organizations can assess their compliance obligations when sourcing or utilizing data originating from China.
Samuel Yang, Partner at Anjie Broad, outlined how the Cybersecurity Law, Data Security Law, Personal Information Protection Law (PIPL), and a growing body of implementing regulations now govern international data transfers. He explained that compliance obligations vary depending on whether an organization is classified as a Critical Information Infrastructure Operator (CIIO) or an ordinary business, with stricter requirements applying to operators handling large volumes of personal or strategically important data.
The central focus of the discussion was the three compliance mechanisms available for lawful cross-border data transfers: CAC Security Assessment, Standard Contract filing, and Certification. Samuel explained that Security Assessments remain the most rigorous option, requiring detailed documentation of data flows, risk assessments, contractual safeguards, and reviews by both provincial and national regulators. Standard Contracts offer a less burdensome process for many organizations, while Certification is currently considered impractical for most businesses. He emphasized that choosing the appropriate pathway depends largely on the volume and sensitivity of the data being transferred.
The webinar also explored China’s heightened protections for sensitive personal information, which includes financial account information, transaction records, biometric data, and other high-risk categories. Lower regulatory thresholds apply when transferring sensitive data internationally, and organizations must obtain separate, explicit consent from affected individuals. It is important to note that inadequate consent remains one of the most common reasons for failed cross-border data transfer applications, making consent management a critical component of compliance strategies, particularly in the financial sector.
Despite the increasingly stringent regulatory environment, there are several important exemptions that can simplify compliance. Transfers necessary for contract performance, multinational HR management, emergency situations, or involving data originally collected outside China may qualify for exemptions from filing requirements. In addition, China’s Free Trade Zones have introduced further localized exemptions to facilitate international business. However, organizations must still complete a Personal Information Protection Impact Assessment (PIPIA), as this remains a standalone legal obligation regardless of whether a filing exemption applies.
Samuel also gave an overview of emerging regulatory developments affecting financial institutions and multinational organizations. New rules now extend data export controls to scenarios involving the cross-border movement of personnel carrying technical knowledge, while sector-specific requirements continue to expand across finance, healthcare, and judicial cooperation. He also discussed China’s evolving approach to “important data,” noting that although the definition remains broad, approvals for qualifying transfers are increasingly common when organizations can clearly demonstrate business necessity and implement robust compliance measures.
Figure 1: Financial Sector Data Classification
Samuel also reviewed recent enforcement trends, noting that Chinese regulators have become significantly more active over the past two years as the initial grace period following the introduction of PIPL has ended. He highlighted several recent enforcement cases, including penalties against multinational companies that transferred personal information to overseas headquarters without using an approved compliance mechanism. Samuel warned that organizations ignoring regulatory directives face severe consequences, with potential fines reaching RMB 50 million or up to 5% of global annual revenue.
Many multinational organizations are choosing to localize their data within China to avoid the complexity of cross-border transfer filings altogether. Obtaining informed consent from individuals remains the cornerstone of successful compliance, while organizations must also be able to clearly demonstrate the necessity of every cross-border transfer.
Simply relying on overseas IT infrastructure or global corporate systems is generally not considered a sufficient justification by Chinese regulators. Robust data mapping, impact assessments, and governance processes therefore remain essential elements of any compliance program.
Figure 2: Practical Compliance
During the Q&A session, Samuel elaborated on several practical issues facing multinational businesses. He explained that regulators may grant partial approval for cross-border data transfers, allowing certain datasets to be transferred while rejecting others that lack a clear business necessity. He also discussed the treatment of financial transaction data, noting that international payment processing may qualify for exemptions, whereas transferring domestic Chinese transaction data to overseas systems solely for operational convenience would generally not satisfy the regulatory necessity test.
On AI, Samuel noted that Chinese large language models are subject to registration and security assessment requirements, while foreign AI providers without a legal presence in China face additional regulatory hurdles.
Looking ahead, Samuel suggested that China’s overall direction is becoming more pragmatic rather than more restrictive. While enforcement is increasing, regulators are also introducing targeted exemptions and engaging with multinational companies to reduce compliance burdens in lower-risk scenarios, such as cross-border HR management. The Standard Contract mechanism is expected to remain the preferred compliance route for most organizations, while Certification is likely to remain a niche option due to its significantly higher operational requirements. Samuel concluded that organizations investing early in data governance, consent management, and comprehensive compliance processes will be best positioned to navigate China’s evolving cross-border data transfer landscape.
The Eagle Alpha Alternative Data Conference returns to New York on September 10, and the agenda is taking shape. Sessions will cover some of the most pressing topics in the market right now, from how firms are operationalizing AI agents across the investment process, to early warning signals in private credit, to the rise of prediction markets as a mainstream institutional tool. Speakers are being confirmed from the likes of Fidelity Investments, Jain Global, Brevan Howard, Millennium, Blackrock, PGIM, Robeco, and UBS, with more to be announced. Click here to register