Data Export: Choosing Among Three Routes, When Filing Is Mandatory, and How to Budget

Data export is the compliance task AI companies most often underestimate. The reason is that it happens naturally: calling an overseas model endpoint, using overseas cloud, letting an overseas team operate systems remotely, aggregating logs at a foreign headquarters. None of this feels remarkable in day-to-day development, and each may legally be a provision of data abroad.

The second underestimation concerns time. All three routes have fixed timelines, the security assessment especially. Starting when the product is about to launch or a customer is about to sign usually means missing the date.

1. First establish whether it is an export

The test is whether data is received or accessible by an overseas entity, not where the server sits.

Four situations are commonly missed:

Calling an overseas model API. Prompts and uploaded files go to an overseas inference node. Even without storage, this is a provision.

Remote operations by an overseas team. Engineers outside the mainland accessing the production database through a jump host constitutes overseas access.

Intra-group sharing. A domestic subsidiary reporting user or operational data to an overseas parent is an export; the affiliate relationship is no exemption.

Overseas customer service and outsourcing. An overseas call centre or labelling team processing user data counts as well.

List these four scenarios first, then decide whether a route is needed. The number of scenarios drives the workload and the budget.

2. Three routes and the exemptions

The Provisions on Promoting and Regulating Cross-Border Data Flows set three tiers by cumulative headcount and data type, with exemptions alongside.

Three points deserve attention. First, the count is cumulative from 1 January of the current year, not per transfer. Second, sensitive personal information is counted separately, and 10,000 records triggers assessment — a far lower threshold. Third, exemption is not exemption from notice and consent; those duties remain.

3. How to count

The count determines the route, and the route determines the timeline, so this step cannot be estimated.

Deduplicate by natural person: repeated transfers of the same user count once. Anonymised data is excluded, but pseudonymised data remains personal information and must be counted. Sensitive personal information includes biometrics, medical health, financial accounts, location trails and data of children under fourteen, and is counted separately.

Most companies can count; what they lack is aggregation by user. Logs, orders and support systems sit in different databases, and a field-level inventory is needed before a usable number emerges.

4. Materials and timelines

Security assessment. Filed through the provincial cyberspace administration. The core is the risk assessment report covering scenarios, categories and volumes, recipient details, transfer method, safeguards and the self-assessment conclusion. The result has a validity period and must be renewed before expiry.

Standard contract. The official template must be used without amending its core clauses. The contract is filed with the provincial administration within ten business days of taking effect. Filing is not approval, but incomplete materials are returned for correction.

Certification. Suited to companies with continuous, multi-scenario exports; the timeline is close to the standard contract route, and one certification covers several scenarios.

None of the three routes works in a vacuum. Prerequisites include a PIA, cross-border disclosure in the privacy policy, and a data processing agreement with the recipient. Missing any one leads to a request for correction.

5. What drives the budget

Four variables: the number of export scenarios, the recipient’s willingness to cooperate, the amount of system change, and whether the company is already under regulatory enquiry.

Scenario count drives the size of the assessment report. Recipient cooperation matters most: whether an overseas model supplier will sign the standard contract, accept audit, and provide an onward-transfer list determines the negotiation timeline. System change depends on whether notice prompts, separate-consent entry points and log retention must be added. If an enquiry has already begun, time compresses and cost rises.

Field inventory and system changes can be done internally; route selection, the risk assessment report and contract negotiation usually need external input.

6. Five common sticking points

The second and fifth are most common. One is a scope problem, the other a continuity problem. Data export compliance is not a one-off act but a process retriggered by business change.

7. Interaction with the PIA, privacy policy and DPA

Data export is a statutory PIA trigger, a required disclosure in the privacy policy, and a matter to be addressed in the DPA with the recipient. The three documents describe one chain, and the wording must agree.

The usual inconsistency: the privacy policy says data “may be provided to overseas affiliates”, the assessment report says “transferred only to one model supplier”, and the DPA has no cross-border clause. A cross-check requires explaining all three.

8. Twelve-week plan

Assessment review time is not included in the twelve weeks and must be added according to actual progress. If a launch date is fixed, the assessment should start at least six months before it.

Related reading: personal information protection impact assessment, data processing agreements in AI, privacy policies for AI products, and the data compliance and multi-jurisdiction service pages.

Last updated: 30 July 2026.