Series
Blogs
China: Will free trade zones' negative- and whitelists ease data exports?
China: Will free trade zones' negative- and whitelists ease data exports?
26 February 2025
Series
Blogs
26 February 2025
Within weeks, the Hainan Free Trade Port has also issued its data export negative list to facilitate data flows from the free trade port.
These negative list developments echo recent cross-border data transfer initiatives in other FTZs, varying from negative lists issued by Tianjin FTZ and Beijing FTZ, to the whitelist approach adopted by Shanghai FTZ Lingang and Fujian Pingtan FTZ.
This note recaps recent FTZ data export initiatives, outlining key takeaways for multinationals operating or considering setting businesses in these regions.
The 22 March 2024 provisions for liberalisation of cross-border data transfers specifically entitle FTZs to develop their own cross-border data transfer rules, including to ease data export restrictions for organisations based in the FTZs.
A negative list means a list of data types whose export from China will be subject to additional restrictions, such as to conduct a government-led data export security assessment, sign a China Standard contract, or to obtain data protection certification. In essence, the reverse implication of these lists is that MNCs located in the FTZs may “freely” transfer out of China data that are not on the negative list, without triggering the above transfer formalities (even if other data privacy requirements still apply). Additionally, the FTZ negative list regimes increase the thresholds at which these transfer formalities apply to exports of certain data types relating to specified industries/sectors.
A whitelist, as an opposite approach, means data types whose export is explicitly permitted by the FTZ regulators. The whitelist approach, as previously adopted in some FTZs such as that in Lingang, Shanghai, appeared to only cover limited scenarios compared with the full-range negative lists released by other FTZs such as Tianjin and Beijing.
An overview of FTZ reforms is available here.
Export of important data is subject to stringent regulations. Businesses have been anticipating the release of industry-specific catalogues on important data by the PRC regulators. However, as of now, there has been only limited guidance or standards available in several industries and sectors.
Notably, the negative lists provide some valuable reference to what industry-specific data types would be more likely to be treated as important data. Taking the Shanghai FTZ negative list as an example, the types of data below are deemed important data in the reinsurance and shipping industries:
|
Industry/sector |
Scope of important data |
|
Reinsurance |
|
|
International shipping |
|
The use of FTZ negative lists is emerging as a viable approach to facilitating cross-border data transfers, providing a simpler alternative pathway for multinational companies operating within China to connect to their global networks. In 2024, Bayer Healthcare became the first company to successfully file a bespoke negative list to widen the scope of its cross-border data transfers from Beijing E-Town.
However, while beneficial, this negative list filing strategy does not waive all compliance obligations falling on multinational companies under China’s national security and data protection laws, such as the eligibility requirements and the record-filing process mentioned above.
Among others, to leverage the FTZ initiative, a multinational company will need to have a presence in, and, as required in most FTZ initiatives, conduct data export activities from, the FTZ. What qualifies as “conducting data export activities” within the FTZs lacks clarification.
A reasonable read would be to refer to the storing, processing, and transferring of the data intended for export in or from the FTZ, with a clear example being that the applicant’s data export nodes or data storage facilities are situated within these zones. However, it is unclear if the negative lists are deemed applicable when data export activities physically occur outside the FTZ, even if the data is contractually exported by a business registered within the relevant FTZ to meet both business needs and the eligibility requirements.
Additionally, since each set of FTZ rules is formulated by a different FTZ and implemented at various times, differences in the criteria adopted by each FTZ may pose challenges for MNCs attempting to maintain a consistent approach when operating across different FTZs.
Multinational corporations looking to leverage the benefits of FTZ initiatives for a more streamlined data export compliance process should consider the following steps:
We are currently working with several clients to analyse these developments. For further guidance or questions, please feel free to reach out.
An overview of Free Trade Zone reforms is available here.