Shanghai and Beijing Publish Updated FTZ Negative Lists for Data Exports

Background: What Is the Negative List Framework?

China’s National Framework on Data Exports

China’s national rules on cross-border data transfers — principally the Provisions on Promoting and Regulating Cross-Border Data Flows (the Provisions) — require entities to rely on a data export mechanism (i.e., passing a security assessment, entering into SCCs with the overseas recipient, or obtaining a privacy certification from designated agencies in China) before transferring personal information overseas, depending on the volume and sensitivity of the data. For an overview of these data export mechanisms, please refer to this Client Alert.

The Provisions permit pilot FTZs to develop their own cross-border data transfer negative lists (Negative Lists). The Negative Lists specify the categories of personal information in certain sectors that require a data export mechanism and the relevant thresholds (based on volume and whether the data includes sensitive personal information) that trigger such a mechanism. The Negative Lists modify the application of China’s national cross-border data transfer requirements for entities established in FTZs, for example by introducing sector-specific exemptions and higher thresholds for certain scenarios, particularly for sensitive personal information transfers.

How the Negative Lists Work in Practice

For entities not established in an FTZ, the national framework on cross-border data transfers under the Provisions continues to apply and the Negative Lists are not applicable.

For entities established in an FTZ, the applicable Negative List must be considered to determine whether the relevant data transfer requires a data export mechanism. The Negative Lists specify, for each covered sector and scenario, the circumstances in which transfers are subject to a data export mechanism. Two outcomes are possible for an entity established in an FTZ:

• The Negative List does not apply: The transfer may proceed without undergoing the applicable data export mechanisms, subject to completion of the required filing procedures with local authorities. Specifically, the Negative List does not apply where: (i) the data processor does not operate in a sector covered by the Negative List, (ii) the data processor does operate in a sector covered by the Negative List, but the data transferred is not covered by the Negative List, or (iii) the transferred volume is below the relevant threshold for SCCs/certification.
• The Negative List applies: The data transfer remains subject to the applicable data export mechanism per the national requirement (security assessments, SCCs, or certification) as specified in the Negative List. Specifically, the Negative List applies where: (i) the data processor operates in a sector covered by the Negative List, and (ii) the data processor transfers covered data that exceeds the relevant thresholds for data export mechanisms.

How to Determine Data Transfer Requirements

Shanghai and Beijing FTZ Negative Lists

Geographical Application

In 2024, Shanghai introduced its Negative List, which was applicable to the Shanghai Pilot FTZ and Lingang Special Area. Beijing also introduced its Negative List in 2024, applicable to the Beijing FTZ.

In 2026, both Shanghai and Beijing updated their Negative Lists. The Shanghai FTZ Negative List took effect on 24 April 2026, and the Beijing FTZ Negative List took effect on 8 May 2026, both superseding the earlier versions. This Client Alert focuses on the Shanghai and Beijing Negative Lists because both cities (in particular the latter) are commonly viewed by other local Cyberspace Administration of China authorities as regulatory benchmarks and reference points.

Both Shanghai and Beijing have expanded the applicable scope of their respective Negative Lists. Shanghai’s Negative List now applies to data processors registered and operating anywhere within Shanghai Municipality, while the Beijing Negative List now covers data processors registered within the Beijing “Two Zones” (the Beijing FTZ and the National Comprehensive Demonstration Area for Expanding the Opening of the Service Sector).

Notably, critical information infrastructure operators (CIIOs) are expressly excluded from the Shanghai Negative List; accordingly, they must follow the national rules under the Provisions when undertaking cross-border data transfers. The Beijing Negative List contains no equivalent exclusion and is intended to “benefit all enterprises city-wide”. CIIOs in Beijing may therefore benefit from the Negative List.

Key Sectors and Thresholds

The Negative Lists ease the compliance burden for some data processors that would otherwise need to apply for a security assessment under the national rules (i.e., the SCCs or certification) and introduce exemptions for data transfers falling below the SCCs/certification thresholds. However, the Negative Lists also increase the compliance burden for some data processors by lowering the thresholds that trigger a data export mechanism under the national framework. Examples are set out below.

Pharmaceuticals — Clinical Trial Subjects (Beijing)

Under the national framework, transfers involving the sensitive personal information of 10,000 or more individuals generally require a security assessment. The Beijing Negative List raises this threshold for clinical trial participant data, which may include subject identification codes, dates of birth, medical records, medication records, and examination reports. Under the Beijing Negative List, a security assessment is required only where the transfer involves 50,000 or more individuals, and transfers involving 10,000 to 50,000 individuals require SCCs or certification rather than a security assessment (as would have been required under the national framework).

Key takeaway: Transfers of clinical trial data involving fewer than 10,000 individuals may proceed without any data export mechanism, subject to completion of the applicable filing procedures. This represents meaningful regulatory relief for pharmaceutical companies conducting multi-site clinical trials involving participants in China.

Pharmaceuticals — Healthcare Professionals and Other Personnel (Beijing)

The Negative Lists do not uniformly reduce regulatory requirements. For example, for healthcare professional (HCP) data that does not qualify as sensitive personal information — such as names, contact details, educational backgrounds, and professional qualifications — the Beijing Negative List requires a security assessment for transfers involving 200,000 or more individuals, which is lower than the national baseline threshold of 1 million individuals for non-sensitive personal information.

Key takeaway: Pharmaceutical companies exporting HCP data from the Beijing FTZ may trigger a security assessment at lower volumes than under the national framework.

Membership / Loyalty Programme Management (Shanghai and Beijing)

The Shanghai and Beijing Negative Lists adopt identical thresholds for membership/loyalty programme management, albeit under different sectors. In Shanghai, this transfer scenario falls under the Commerce and Trade sector (covering retail, catering, and hospitality enterprises), whereas in Beijing it falls under the Retail and Modern Services sector (which also extends to software, IT services, and internet information services enterprises).

A security assessment is required only where transfers involve the non-sensitive personal information of 10 million or more individuals or the sensitive personal information of 1 million or more individuals. By comparison, the national framework requires a security assessment of 1 million individuals for non-sensitive personal information or 10,000 individuals for sensitive personal information. Similarly, under the Negative Lists, transfers involving 1 million to 10 million individuals’ non-sensitive personal information or 100,000 to 1 million individuals’ sensitive personal information require SCCs or certification rather than a security assessment.

Key takeaway: Transfers of membership/loyalty data involving fewer than 1 million individuals (for non-sensitive personal information) and 100,000 individuals (for sensitive personal information) may proceed without any data export mechanism, subject to completion of the applicable filing procedures. This represents meaningful regulatory relief for multinational retailers, hospitality groups, and other businesses operating large-scale customer loyalty programmes in the Shanghai and Beijing FTZs.

The table below summarises the key personal information thresholds for certain sectors under the Negative Lists that trigger a data export mechanism. The table is not exhaustive of all sectors or data categories covered by the Negative Lists and only outlines certain sectors/scenarios.

By way of comparison, the national rules under the Provisions require the following data export mechanisms where personal information greater than the relevant threshold is exported:

• Security assessment: more than 1 million individuals (non-sensitive personal information) or 10,000 individuals (sensitive personal information)
• SCCs/certification: more than 100,000 individuals but fewer than 1 million individuals (non-sensitive personal information) or fewer than 10,000 individuals (sensitive personal information)

Key Thresholds for Certain Sectors’ Personal Information Transfers That Trigger a Data Export Mechanism Under the Negative Lists

*Combined PI: Instead of defining the threshold as either sensitive or non-sensitive personal information (PI), which is the case for other transfer scenarios, for this particular data transfer scenario, the Negative List prescribes certain categories of personal information (e.g., certain basic personal information together with health-related sensitive information) which are subject to the relevant data export mechanism where the threshold is exceeded. Accordingly, the data processor to which this scenario applies will need to consider both non-sensitive and sensitive PI.

†More permissive = The Negative List threshold is higher than the national baseline. In other words, the data processor is better off under the Negative List framework.

‡More restrictive = The Negative List threshold is lower than the national baseline. In other words, the data processor is worse off under the Negative List framework.

Sector Comparison

The Shanghai and Beijing Negative Lists cover different sectors, reflecting distinct national policy priorities and the sectors and data types that are viewed as critically important and require enhanced regulatory oversight. The Shanghai Negative List focuses on facilitating cross-border trade, financial services, and shipping logistics, while the Beijing Negative List focuses on data-intensive and technology innovation sectors.

The only scenario in the two Negative Lists that materially overlaps is membership/loyalty programme management (applicable to the Commerce and Trade (Retail, Catering/Hospitality) in the Shanghai Negative List, and Retail and Modern Services in the Beijing Negative List). Both Negative Lists adopt comparable thresholds for this scenario, with security assessments required only for large-scale transfers involving 10 million or more individuals (for transfers of non-sensitive personal information) or 1 million or more individuals (for transfers of sensitive personal information).

Shanghai Negative List

• Reinsurance
• International Shipping (water transportation / ports / crew management)
• Commerce and Trade (retail, catering/hospitality)
• Meteorology

Beijing Negative List

• Automotive
• Pharmaceuticals
• Civil Aviation
• Retail and Modern Services
• AI Training Data
• Medical Devices
• Autonomous Driving (intelligent connected vehicles)
• Trade Logistics
• Banking

Filing Process for Exempt Data Transfers

After confirming that the data to be exported does not fall within the Negative List, data processors must complete a filing with local authorities. The filing enables the authorities to confirm that the data does not fall within the Negative List and that a data export mechanism is not required for the transfer. The process involves submitting an application form, supporting documentation, and a commitment letter to the local authority.

In Shanghai, filings are submitted to the district-level Cross-Border Data Transfer Service Centre after which the Shanghai Municipal CAC and Shanghai Data Bureau will review the filings. In Beijing, filings are submitted through the Beijing Municipal Cross-border Data Flow Public Service Platform, which first conducts a preliminary review, followed by a joint assessment by the Beijing Municipal CAC, the Municipal Bureau of Commerce, and the Municipal Government Services and Data Management Bureau, among other local authorities.

In both cases, authorities will review the filings within 10 working days and notify the applicant of the outcome. In Beijing, the filing result notification is valid for three years. There is no fixed validity period for Shanghai, but data processors must update their filings if there are material changes to the relevant data export activities.

Important Data Identification

Both Negative Lists include guidance for identifying “important data”, which always requires a security assessment regardless of volume, consistent with the national framework. The Negative Lists provide sector-specific examples of important data, offering practical guidance for entities in assessing whether their datasets may constitute important data, which always require a security assessment. The examples reflect the different sector focuses of the Shanghai and Beijing Negative Lists. The following includes a non-exhaustive list of key examples of important data identified in the Negative Lists:

Sector-Specific Examples

Shanghai Negative List

• Underwriting and claims data for important national facilities, equipment, and personnel, and data involving sensitive entities such as party and government organs or defence facilities (reinsurance sector)
• Undisclosed data that, if disclosed, could materially affect economic operations or social stability
• Port operational, security, and strategic management data (international shipping sector)
• Meteorological data meeting national thresholds for scale or precision, including AI training datasets derived from such data (meteorology sector)

Beijing Negative List

• Vehicle exterior imagery and geographic information that could reveal sensitive military zones or defence facilities (automotive and autonomous driving sectors)
• Population-scale healthcare data involving 100,000 or more individuals (in pharmaceuticals and medical devices sectors)
• Undisclosed frontier biotechnology R&D and drug production data
• High-value algorithm source code, foundational model data, and training datasets relating to industry competitiveness (AI training data sector)
• Data exploitable for cyberattacks on critical information infrastructure (banking sector)
• Customs and logistics data reflecting national economic trends in strategic sectors

Importantly, the Shanghai Negative List does not appear to introduce new categories of important data beyond the national framework but rather operationalises existing identification criteria under the national important data identification framework by providing greater sector- and scenario-specific detail. The Beijing Negative List adopts a broader sector-specific approach, providing more detailed descriptions of potential important data categories and scenarios, particularly in technology-intensive sectors.

Next Steps

Entities operating in, or considering reliance on, the FTZ Negative List framework may wish to consider taking the following steps:

• Assess applicability. Confirm whether the entity is established within the relevant FTZ area. Entities outside the relevant geographical area remain subject to the national framework under the Provisions.
• Identify the relevant sector, scenario, and data category. Map cross-border data transfers against the applicable sector-specific scenarios, as different categories of data within the same sector may be subject to different thresholds and requirements.
• Compare requirements against the national framework. Do not assume that the Negative Lists uniformly reduce regulatory requirements. While the Negative Lists generally introduce higher thresholds and additional exemptions (making it easier to export data), certain scenarios may impose stricter requirements than the national baseline. For example, the Beijing Negative List applies a lower security assessment and SCC/certification threshold (i.e. stricter requirements as compared to the national framework) for non-sensitive HCP data.
• Assess whether any data may constitute “important data”. Both Negative Lists provide sector-specific examples of “important data” to facilitate their identification. Transfers involving important data continue to require a security assessment regardless of volume.
• Complete applicable Negative List filing procedures. Where entities rely on the Negative List framework, they should complete the required filing procedures with the relevant local authorities and retain supporting documentation. Filings should be updated where there are material changes to the relevant data processing activities.
• Monitor regulatory developments. The Negative List framework is expected to continue to evolve. Entities should periodically reassess their compliance positions as new lists or guidance are introduced.

This Client Alert was prepared with the assistance of Zurui Yang in the Beijing office of Latham & Watkins.