Checking In, Checking Out – Chinese New Rules To Data Silver Road

Introduction

The beginning of 2026 marked a definitive turning point in China’s digital regulatory landscape. With the simultaneous implementation of the revised Cybersecurity Law (“CSL”) and the Measures for Certification of Cross-Border Provision of Personal Information (“Certification Measure”), Chinese authorities effectively completed its sophisticated legal framework for digital economy that prioritizes accountability and national security. The impact of the changes brought might be best understood through an illustrative scenario of hotel booking.

In a recent policy Q&A, the Cyberspace Administration of China ("CAC") offered a highly illustrative clarification regarding exemptions for data transfers. While sending data abroad to fulfill a customer's overseas hotel reservation is strictly necessary for contract performance and therefore fully exempt from complex filing requirements, transferring that same data for a domestic booking merely because a company's servers are in