Intelligence

China's cross-border data transfer regime has moved from paper framework to active enforcement in 2026, with regulators issuing significant fines and new rules for both small and large data processors. The three-pathway framework of CAC security assessment, Standard Contract filing, and personal information protection certification is now fully operational, creating real compliance obligations for any business moving personal data out of China.

China's new regulation introduces simplified compliance measures for small-scale personal information processors handling data of fewer than 100,000 individuals.

2022年，一场震惊全球的数据泄露事件将某知名国际网约车公司推上风口浪尖。黑客通过社交工程手段攻破其第三方供应商员工的VPN权限，进而入侵多个内部系统，导致大量员工和司机的姓名、邮箱、位置信息、账户内容等个人数据遭到外泄。事件发生后，美国联邦贸易委员会（FTC）率先发起调查&#

China's Cyberspace Administration and Ministry of Public Security have jointly issued new regulations establishing simplified personal information protection compliance measures specifically for small-scale data processors.

2026年6月3日，爱尔兰高等法院在 TikTok Technology Limited v Data Protection Commission [2026] IEHC 347 一案中，就TikTok针对爱尔兰数据保护委员会（DPC）关于数据跨境传输的处罚决定提出的上诉作出实体判决...

China’s new Automotive Data Cross-border Transfer Guidelines (2026 Edition) (Guidelines), jointly issued by eight Chinese ministries and effective July 1, 2026...