On 30 May 2025 the Cyberspace Administration of China published its policy Q&A on outbound data security management. The Q&A consolidates rules that had previously been scattered, and it concentrates on two questions: how important data is identified, and how it is declared once identified.
Important data is the hinge of the export regime
Of the three pathways for outbound data, the security assessment has the highest threshold, and the core variable that triggers it is “important data”. The Q&A confirms that a data processor should identify and declare important data in accordance with national rules, and that exporting important data requires a security assessment organised by the national cyberspace authorities.
For AI companies, training data, industry corpora and user profiles can all approach the boundary of important data. Identification cannot be left to intuition.
Two months: a defined window
The Q&A sets an executable timing requirement: where a processor has been told, or a public notice has been issued, that data is important, the processor should apply to the provincial cyberspace department for an outbound data security assessment within two months of that notification or publication.
The significance of this timeline is that it converts “when must we act” from a vague “promptly” into a measurable deadline.
How it relates to the three pathways
Security assessment is not the only route for outbound data. A company has to judge, by data type and volume, whether the assessment, a standard contract or certification applies. See our notes on outbound personal information certification and on obligations of major personal information processors.
Where companies can start
First, build a data asset inventory, flagging separately the fields and datasets that may constitute important data.
Second, write the two-month window into internal process, so that application preparation starts automatically when a notification or public announcement appears.
Third, assess across jurisdictions in parallel; a single outbound transfer may trigger both a domestic assessment and overseas compliance duties. See our notes on network data security risk assessment measures and on the opinion on data circulation service institutions.
The difficulty in outbound data compliance is not the rules themselves but whether a company knows what data it holds. Identification capability sets the starting point for compliance.
This article is based on the Cyberspace Administration of China’s Policy Q&A on Outbound Data Security Management (May 2025) and public information and is for reference only; it does not constitute legal advice.