One Key Take-Away from FAQ on Cross-Border Data Transfers

Background

On 30 May 2025, the Cyberspace Administration of China (CAC) released a new FAQ regarding the management of cross-border data transfers. This long-awaited clarification provides significant relief to enterprises navigating the complex regime of data export compliance under China's Data Security Law and associated regulations.

Key Clarification: No Immediate Obligation Without Sector-Specific Standards or Notification

One of the most notable take-aways is the CAC's confirmation that companies are not required to classify and report "important data"—a prerequisite for data export security assessments—unless their industry authority has either (1) issued classification and identification rules or (2) explicitly notified them to begin this process.