- The CAC “Provisions on Promoting and Regulating Cross-Border Data Flows” (CAC Decree No. 16, 22 March 2024) let free-trade zones formulate their own data-export negative lists under the national data classification framework.
国家网信办《促进和规范数据跨境流动规定》（2024年3月22日，第16号令）授权自由贸易试验区在国家数据分类分级保护制度框架下自行制定数据出境负面清单。- A free-trade zone’s negative list identifies the data whose outbound provision still requires security assessment, standard contract or certification; data outside the list may flow out freely without those filings.
自贸试验区负面清单列明仍须申报安全评估、订立标准合同或通过认证方可出境的数据；清单外数据可免予申报、自由出境。- Tianjin released China’s first FTZ data-export negative list (May 2024), dividing outbound data into 13 categories and 46 sub-categories with concrete examples.
天津于2024年5月发布全国首份自贸试验区数据出境负面清单，将出境数据分为13大类46子类并辅以具体示例。- Shanghai (Lin-gang) published its negative list (February 2024) covering finance (reinsurance), shipping and commerce across 6 scenarios and 84 data items, with field-level detail and a “use-first, file-later” approach.
上海（临港）于2024年2月发布负面清单，覆盖金融（再保险）、航运、商贸3个领域6个场景84个数据项，细化至字段级并实行”先用后报”。- Beijing’s FTZ negative list (August 2024) is the first scenario- and field-level list, spanning autos, pharma, civil aviation, retail and AI training data across five industries.
北京自贸试验区负面清单（2024年8月）为首个场景化、字段级清单，涵盖汽车、医药、民航、零售与现代服务业、人工智能训练数据5个行业。- Foreign-invested enterprises in FTZs should map outbound data to the applicable negative list, use the one-stop data centre service, and rely on the list’s free-flow carve-out to cut compliance cost.
区内外商投资企业应将出境数据对照适用负面清单，利用一站式数据跨境服务中心，并借助清单”清单外自由流动”豁免降低合规成本。
FTZ Data Export Negative List and Facilitated Cross-Border Channels | 自由贸易试验区数据出境负面清单与便利化通道
Why this matters now
For a foreign-invested enterprise moving R&D, manufacturing, sales or HR data across borders, China’s data-export rules have long been criticised as uncertain — particularly the vague definition of “important data.” The 2024 reform changed the geometry of that problem. By empowering each free-trade zone (FTZ) to publish its own data-export negative list, Beijing created a field-level, scenario-based map that tells companies, with far greater precision, which data can leave freely and which still triggers a security assessment, standard contract or certification. For multinationals clustered in FTZs, the negative list is now the single most practical compliance instrument for cross-border data.
The enabling rule
The Provisions on Promoting and Regulating Cross-Border Data Flows (Cyberspace Administration of China Decree No. 16, effective 22 March 2024) is the legal foundation. Article 6 authorises an FTZ, within the national data classification and grading protection system, to formulate its own list of data that must enter the security-assessment / standard-contract / certification regime, subject to provincial cyberspace-authority approval and filing with the national cyberspace and data authorities. Critically, data exported by an FTZ entity that falls outside the negative list is exempt from the security assessment, standard contract and certification obligations. The Provisions also carve out routine cross-border scenarios — international trade, cross-border transport, academic cooperation, multinational manufacturing and marketing, and certain HR-management and low-volume personal-information transfers — from filing requirements altogether.
Tianjin: the first negative list
In May 2024, the China (Tianjin) Pilot Free Trade Zone became the first to issue a data-export negative list under the new rule — now filed with the national authorities. It organises outbound data into 13 major categories and 46 sub-categories spanning biomedicine, services outsourcing, finance, internet platforms, automotive, integrated circuits, meteorology and international trade, with detailed feature descriptions and concrete examples for each. The list makes “important data” identifiable rather than abstract: a chemical firm’s hazardous-materials transport-route planning, for instance, is explicitly mapped to a sub-category requiring security assessment. Together with Tianjin’s earlier data classification standard, it forms a “double first” policy system for cross-border data.
Shanghai (Lin-gang): field-level and “use-first”
Shanghai published its negative list (February 2024, with a management measure and implementation guide) covering finance (reinsurance), shipping (international shipping) and commerce (retail, food and beverage, accommodation) — six scenarios and 84 data items. Its distinguishing features:
- Scenario names are listed first, so companies can match their activity directly.
- Important-data features are refined in finance and shipping to aid identification.
- Thresholds are eased where risk is controllable — for example, the sensitive personal-information assessment threshold in commerce membership management rises from 10,000 to 1,000,000, sharply lowering compliance cost.
- A “use-first, file-later” principle applies: no entry barrier — a company simply submits its negative-list usage materials within 15 working days of starting the export.
- Five district service centres plus a Lin-gang centre provide one-stop policy consultation and pre-check.
Beijing: scenario- and field-level pioneer
Beijing’s FTZ negative list (August 2024) was the first scenario- and field-level list, proposing a 13-category / 41-sub-category reference framework and enumerating compliance measures for five industries — automotive, pharmaceutical, civil aviation, retail and modern services, and AI training data — across 48 data categories. It added a provincial pre-review and pre-assessment mechanism and a green-channel service covering more than 100 enterprises in five sectors.
The compliance upside
The negative-list model turns data-export compliance from a national guess into a local, field-level answer. For an FIE, three gains stand out: first, certainty — once a dataset is mapped out-of-list, the assessment/contract/certification filings drop away; second, speed — Shanghai’s “use-first, file-later” removes the pre-clearance wait for in-list routine flows; third, cost — eased thresholds (such as Tianjin and Shanghai raising sensitive-PI triggers) materially lower the volume of filings. The trade-off is geography: the list is FTZ-specific, so an entity outside a pilot zone cannot rely on it and must fall back to the national thresholds in the CAC Provisions. Multinationals should therefore weigh FTZ location as a data-governance variable, not merely a tax or logistics one.
Practical steps for foreign-invested enterprises
- Locate your FTZ and list. Determine which FTZ your entity sits in (Tianjin, Shanghai/Lin-gang, Beijing, or others referencing them) and pull the applicable negative list.
- Map data to scenarios and fields. Use the scenario-first, field-level structure to classify each outbound dataset as in-list or out-of-list.
- Claim the free-flow carve-out. For out-of-list data, document the basis and export without the assessment/contract/certification filings.
- Use the one-stop centre. Submit materials within the prescribed window and use pre-check to de-risk.
- Watch interoperability. Shanghai and others mutually recognise negative lists; a list published by another FTZ may be referenced, so monitor second-batch lists in your sector.
Related reading
The negative list is one lane of China’s three-track data-export system — alongside the security assessment, the standard contract and certification. FIEs should read the FTZ list together with the national thresholds in the CAC Provisions and the general data-security and personal-information rules.
自由贸易试验区数据出境负面清单与便利化通道
为何当下值得关注
对跨境传输研发、制造、销售或人力资源数据的外商投资企业而言，中国的数据出境规则长期因”重要数据”界定模糊而被视为不确定。2024年的改革改变了这一问题的几何结构。通过授权每个自由贸易试验区（FTZ）发布各自的数据出境负面清单，决策层创建了一张字段级、场景化的地图，以更高精度告知企业：哪些数据可自由出境，哪些仍须触发安全评估、标准合同或认证。对聚集在自贸区的跨国企业而言，负面清单已成为跨境数据合规最务实的单一工具。
授权规则
《促进和规范数据跨境流动规定》（国家互联网信息办公室令第16号，2024年3月22日施行）是法律基础。第六条授权自由贸易试验区在国家数据分类分级保护制度框架下，自行制定区内须纳入数据出境安全评估、个人信息出境标准合同、个人信息保护认证管理范围的数据清单，经省级网信委员会批准并报国家网信部门、国家数据管理部门备案。关键在于，自贸试验区内数据处理者向境外提供负面清单外的数据，可免予申报安全评估、订立标准合同、通过认证。该规定还将国际贸易、跨境运输、学术合作、跨国生产制造与市场营销，以及特定人力资源管理与低量级个人信息传输等常规场景，整体排除出申报要求。
天津：首份负面清单
2024年5月，中国（天津）自由贸易试验区率先发布新规下的数据出境负面清单（已完成国家备案）。其将出境数据分为13大类46子类，覆盖生物医药、服务外包、金融、互联网平台、汽车、集成电路、气象、国际贸易等领域，并对每一类给出详细特征描述与具体示例。清单使”重要数据”从抽象变为可识别：例如某化工企业的危化品运输路线规划，被明确映射至须申报安全评估的子类。叠加天津此前的数据分类分级标准，形成自贸试验区”双首个”数据跨境政策体系。
上海（临港）：字段级与”先用后报”
上海于2024年2月发布负面清单（配套管理办法与实施指南），覆盖金融（再保险）、航运（国际航运）、商贸（零售与餐饮、住宿）三大领域，涉及6个场景84个数据项。其突出特征：
- 场景名称前置单列，便于企业直接对应适用。
- 在金融、航运领域对重要数据进一步细化，辅助识别。
- 风险可控前提下放宽阈值——例如商贸会员管理场景的敏感个人信息安全评估阈值由1万提升至100万，显著降低合规成本。
- 实行“先用后报”原则：不设准入门槛，企业自开展数据出境活动之日起15个工作日内提交使用材料即可。
- 五大片区服务中心加临港中心提供一站式政策咨询与材料初核。
北京：场景化、字段级先锋
北京自贸试验区负面清单（2024年8月）为首个场景化、字段级清单，提出13大类41子类参考规则，并列举汽车、医药、民航、零售与现代服务业、人工智能训练数据5个行业48类数据的出境合规措施。其增设省级预审核、预评估机制，并建立覆盖5个行业100余家企业的绿色通道服务。
合规红利
负面清单模式将数据出境合规从”全国猜谜”转变为”本地、字段级作答”。对外资企业而言，三重收益突出：其一，确定性——数据集一旦被归入清单外，评估/合同/认证申报即告免除；其二，速度——上海”先用后报”免除了清单内常规流程的事前审批等待；其三，成本——放宽后的阈值（如天津、上海上调敏感个人信息触发线）大幅减少申报量。代价是地域性：清单以自贸区为界，区外实体无法依赖，须回退至《促进和规范数据跨境流动规定》的全国统一阈值。因此，跨国企业应将自贸区选址视为数据治理变量，而非仅关乎税收或物流。
外商投资企业实务步骤
- 定位所在自贸区与清单。 确定实体所属自贸区（天津、上海/临港、北京或参照它们的其他区），调取适用负面清单。
- 将数据映射到场景与字段。 利用”场景前置、字段级”结构，将每个出境数据集归类为清单内或清单外。
- 主张自由流动豁免。 对清单外数据，留存依据并免予评估/合同/认证申报即可出境。
- 使用一站式中心。 在规定时限内提交材料，借助初核降低风险。
- 关注互认与扩围。 上海等地可参照执行其他自贸区清单；密切跟踪本行业第二批清单。
延伸阅读
负面清单是中国数据出境”三轨”（安全评估、标准合同、认证）中的一条快捷通道。外资企业应将自贸区清单与《促进和规范数据跨境流动规定》中的全国统一阈值及数据安全、个人信息保护一般规则一并研读。
Sources
- 国家互联网信息办公室令第16号：《促进和规范数据跨境流动规定》（2024-03-22）— https://big5.www.gov.cn/gate/big5/www.gov.cn/gongbao/2024/issue_11366/202405/content_6954192.html
- 天津自贸试验区数据出境管理清单（负面清单）（2024版）— https://big5.www.gov.cn/gate/big5/www.gov.cn/lianbo/difang/202405/content_6950083.htm
- 中国（上海）自由贸易试验区及临港新片区数据出境管理清单（负面清单）（2024版）答记者问（临港新片区管委会）— https://www.lingang.gov.cn/upload/1/cms/content/editor/ac2a296d-70a3-47fc-9008-fe5d887eaf73.pdf