China unveils new auto data transfer rules

China's industry regulator, along with seven other government authorities, jointly issued new national guidelines on Tuesday aimed at governing the cross-border flow of automotive data, a move designed to bolster data security as the country's auto industry becomes increasingly digital and globally connected.

For the first time, China has set out specific rules regarding "important data", identifying 27 categories and 51 types of data that could trigger enhanced oversight.

The guideline requires companies handling automobile data to carry out security assessments before data transfers, adopt standard contracts for personal information leaving the country and adhere to detailed rules for determining what constitutes "important data".

The goal is intended to help businesses institutionalize compliance and improve protection of sensitive information as they engage in international cooperation and exports.

The guidelines target three types of cross-border behavior by data handlers, the Ministry of Industry and Information Technology (MIIT) said. These include transferring data generated during domestic operations to overseas locations; allowing foreign entities to query, retrieve, download or extract data stored in China; and other activities involving processing of personal data of Chinese residents abroad in accordance with the personal information protection law.

China's vehicle production and sales both topped 34 million units in 2025, with exports exceeding 7 million. As vehicles increasingly incorporate smart, connected and autonomous capabilities, they generate massive volumes of data. For instance, test vehicles designed for high-level autonomous driving can produce as much as 10 terabytes of data per day.