On 30 January 2026, China released the Automotive Data Cross-Border Transfer Security Guide (2026 Edition), jointly issued by multiple authorities led by the Ministry of Industry and Information Technology in coordination with the Cyberspace Administration of China and other agencies. The Guide provides sector-specific implementation rules governing cross-border transfers of automotive data and is positioned as a practical compliance framework under China’s existing data governance regime.
Scope and Definition of Data Export
The Guide applies to automotive data processors, including OEMs, suppliers, and technology providers. It covers data generated throughout the vehicle lifecycle, including R&D, production, testing, connected vehicle operations, and over-the-air updates. Importantly, “data export” is defined broadly to include not only physical transfers but also remote access by overseas entities, bringing a wide range of cross-border data scenarios within regulatory scope.
Regulatory Pathways for Data Transfers
The Guide confirms that cross-border transfers must follow one of three established compliance mechanisms:
- Security assessment administered by the Cyberspace Administration of China, mandatory for transfers involving important data or large-scale personal data;
- Standard contract filing for personal data exports below regulatory thresholds;
- Certification mechanisms for qualifying transfer arrangements.
Companies are required to determine the applicable pathway based on data classification, volume, and risk profile prior to export.
Sector-Specific Definition of Important Data
The Guide introduces detailed criteria for identifying “important automotive data”, including:
- high-precision geographic and mapping-related data;
- vehicle operation and sensor data at scale;
- battery management and control system data;
- traffic and public security-related information.
Such data may trigger mandatory security assessments or additional regulatory approvals, particularly where mapping or location-sensitive data is involved.
Exemptions and Facilitated Scenarios
Nine exemption scenarios are introduced, allowing limited cross-border transfers without full security assessment, particularly for product defect handling, vulnerability remediation, and emergency response. These scenarios remain subject to filing or reporting requirements and do not constitute blanket exemptions.
Operational Compliance Requirements
The Guide requires companies to implement end-to-end data governance controls, including:
- internal data classification frameworks;
- technical safeguards such as anonymization and access controls;
- record-keeping of data export activities;
- incident response and monitoring mechanisms.
Regulatory submissions must include data characteristics, scale, purpose, and transfer pathways, rather than raw datasets.
Compliance Implications
The Guide establishes a sector-specific compliance benchmark for automotive data exports in China. Companies must align internal processes to ensure:
- accurate identification of important data;
- correct selection of export mechanisms;
- readiness for regulatory filings and audits;
- control over cross-border access to vehicle and operational data.
Failure to align with these requirements may result in regulatory enforcement under China’s data security framework, particularly where sensitive automotive or location-based data is involved.
Kindly refer to the following official guide from the government agency:
https://gxt.fujian.gov.cn/jdhy/zxzcfg/gjzcfg/202603/P020260305539874791491.pdf