Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 22 SEPTEMBER 2026

China Cross-border Data Transfer: Enforcement Has Arrived

BUREN
BUREN
Contributor
BUREN

BUREN

BUREN is an independent, internationally oriented firm of lawyers, civil-law notaries and tax...

View firm profile
Explore more from BUREN

China's cross-border data transfer regime has moved from paper framework to active enforcement in 2026, with regulators issuing significant fines and new rules for both small and large data processors. The three-pathway framework of CAC security assessment, Standard Contract filing, and personal information protection certification is now fully operational, creating real compliance obligations for any business moving personal data out of China.

ChinaPrivacy
Jan Holthuis
Jan Holthuis
Yongmei Evers-Cai
Yongmei Evers-Cai
Author LinkedIn connections

China's cross-border data transfer regime is no longer a paper framework. The three-pathway framework of the Cyberspace Administration of China (CAC) security assessment, Standard Contract (SCC) filing, and Personal Information (PI) protection certification has been fully operational since 1 January 2026. Regulators have now shifted their focus decisively from rulemaking to implementation and enforcement.

2026 has been the year of enforcement, highlighted by a RMB 10 million fine against Ctrip, a landmark case against Dior, and sweeping new rules for both small and giant data processors. If your business moves personal data out of China — including HR files, customer records, or app data — here is what has changed, and what you need to do about it.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

中企出海法律合规系列——数据泄露应对全流程指南

2022年，一场震惊全球的数据泄露事件将某知名国际网约车公司推上风口浪尖。黑客通过社交工程手段攻破其第三方供应商员工的VPN权限，进而入侵多个内部系统，导致大量员工和司机的姓名、邮箱、位置信息、账户内容等个人数据遭到外泄。事件发生后，美国联邦贸易委员会（FTC）率先发起调查&#
ChinaPrivacy
AnJie Broad Law Firm
AnJie Broad Law Firm
Article

China Revises Good Clinical Practice Rules

China's revised Good Clinical Practice for Drug Trials took effect on 1 September 2026, fundamentally reshaping the regulatory landscape for clinical trials by aligning domestic requirements with ICH E6(R3) standards. The new framework introduces streamlined regulations spanning just 54 articles across six chapters, while establishing comprehensive data governance requirements and clarifying ultimate accountability for sponsors, principal investigators, and clinical trial institutions. Companies conducting
ChinaFood, Drugs, Healthcare, Life Sciences
BUREN
BUREN
Article

Bankruptcy Of Hortilux, Agrilight And AP Nederland B.V.

Stefan van Wijk of BUREN has been appointed administrator following the bankruptcy of six Dutch companies operating under the Hortilux and Agrilight brands, which manufacture lighting installations for greenhouse horticulture and livestock housing. With over ten parties already expressing interest and intensive restart efforts underway, the administrator is preparing an information memorandum to facilitate potential acquisitions while maintaining operations in the interim.
NetherlandsInsolvency/Bankruptcy/Re-Structuring
BUREN
BUREN
Article

Practical Implications Of Consumption Restriction On Foreign Legal Representatives Of Chinese Companies

Foreign nationals serving as legal representatives of Chinese subsidiaries face significant practical consequences when their companies fail to comply with court judgments. Consumption restrictions may limit travel options, hotel stays, and other expenditures, while exit restrictions can prevent departure from China entirely. Understanding these enforcement measures and their implications is essential for foreign legal representatives operating in China's business environment.
ChinaLitigation, Mediation & Arbitration
BUREN
BUREN
Article

Dutch Public Country-by-country Reporting: Is Your Group Ready For The First Reports Due In 2026?

The Netherlands has introduced public country-by-country reporting requirements for large multinational groups with consolidated revenue above EUR 750 million. These new rules will make tax data publicly accessible through the Dutch trade register, allowing journalists, NGOs, investors and competitors to review tax information by jurisdiction. Groups with a calendar financial year must publish their first report by the end of 2026, covering the 2025 financial year.
NetherlandsTax
BUREN
BUREN
Article

Checking In, Checking Out – Chinese New Rules To Data Silver Road

China's digital regulatory landscape reached a turning point in early 2026 with the simultaneous implementation of the revised Cybersecurity Law and new Certification Measures for cross-border data transfers. These developments introduce a sophisticated framework that rewards precise, necessity-based data governance while expanding extraterritorial reach and establishing clear compliance pathways for multinational corporations operating in China's digital economy.
ChinaPrivacy
BUREN
BUREN
Article

CJEU Provides Further Guidance On The Anti-abuse Rules Under The EU Parent-Subsidiary Directive

The Court of Justice of the European Union has ruled that Member States may deny dividend withholding tax exemptions under the Parent-Subsidiary Directive even when the receiving parent company maintains genuine economic activity. This landmark decision examines whether tax authorities can look beyond immediate corporate structures to assess the entire chain of transactions for artificial arrangements designed to obtain tax advantages.
European UnionTax
BUREN
BUREN