The Provisions on Promoting and Regulating Cross-border Data Flows took effect on 22 March 2024, adjusting the thresholds and exemptions for security assessment, standard contracts and certification. The textual change is limited; the practical difficulty is sharper. Reverse the order of analysis and complete materials still have to be redone. The workable order is to characterise the data, count the individuals, then choose the route.
Start with whether the data is important data
Data not notified or publicly designated as important data by the relevant authorities or regions does not require a security assessment on important-data grounds. The presumption reduces the burden for most companies but requires a record of the reasoning. Three steps help: check the important-data catalogue issued by the sector regulator; keep written records of enquiries and exchanges; state the conclusion and reasons internally. A presumption is not a licence to skip the analysis. If data is later designated as important, missing records make responsibility hard to explain and affect transfers already completed.
The order of route selection
The analysis proceeds in four steps: whether the entity is a critical information infrastructure operator; whether it processes important data; whether personal information exports reach the volume threshold; whether an exemption applies. Only then does the choice between standard contract and certification arise. Putting route selection before volume calculation is a common error: exemptions address specific scenarios, thresholds address cumulative scale, and the conditions are not interchangeable. A transaction covered by an exemption needs no standard contract; one above the threshold cannot avoid filing by splitting contracts.
What the materials must actually answer
The core of a filing is the self-assessment report and the legal documents. The report should explain the purpose and method of transfer, the scope of data, the overseas recipient’s processing capability and legal environment, and the security measures to be adopted. AI companies must also add the provenance of training data, the categories transferred in model services, and logging for overseas interface calls. The weight lies not in length but in whether the materials answer “what happens after the data leaves”; correspondence between architecture, data flows and contractual obligations is more persuasive than repeating statutory language.
Timelines and parallel workstreams
Security assessment, standard contract filing and certification each have their own process periods. Time must be reserved for acceptance, supplementary materials and notification of the result; launch should not be scheduled backwards from the shortest timeline. Companies using overseas cloud services, model interfaces and customer service systems often trigger several routes and should file by business module, not as one generic “data export” matter. Splitting clarifies responsibility boundaries, and a correction on one route does not hold up the others.
Three AI-specific scenarios
- Training data export. Transferring corpora to an overseas parent company or labelling provider is a typical export; public data is no exception, and the key question is whether it can be accessed by an overseas entity.
- Overseas inference calls. Sending user input to an overseas model service and returning the result constitutes an export; whether the threshold is met depends on the volume and sensitivity of the personal information involved.
- Return of overseas user data. Business data flowing back into China runs in the opposite direction but still requires analysis under inbound rules and local law abroad; a one-way assessment is not enough.
For companies that both train and deploy models, map the data flows down to the interface layer and assess them one by one, not by department.
For route analysis and preparation, see our data compliance service; for recipient arrangements and cross-border agreements, see cross-border data services; for parallel requirements in multiple jurisdictions, see multi-jurisdiction compliance.
This article is based on the Provisions on Promoting and Regulating Cross-border Data Flows, in force from 22 March 2024, and on public information. It is for reference only and does not constitute legal advice.