- The 2026 action plan supports FTZs and service-opening pilot cities in exploring scenario-based, field-level data-export negative lists.
2026年行动方案支持自贸区、服务业扩大开放试点城市在更多领域制定场景化、字段级数据出境负面清单。- National standards for “important data” identification catalogs will be promoted for eight industries (industrial, telecom, geoinformation, automotive, pharma, seeds, aerospace, civil aviation).
将推动工业、电信、地理信息、汽车、医药、种业、航天、民航等八个行业领域重要数据识别目录国家标准制定。- This refines the general PIPL cross-border-transfer rules with more granular, locally-tailored negative lists.
这以更细粒度、因地制宜的负面清单，细化了个保法项下的一般跨境传输规则。- FIEs should check whether an applicable FTZ negative list or industry important-data catalog covers their cross-border transfers.
外资企业应核实在适用的自贸区负面清单或行业重要数据目录是否覆盖其跨境传输。- It complements the existing cross-border data transfer rules and PIPL compliance articles rather than replacing them.
该举措是对现有跨境数据传输规则与个保法合规文章的补充，而非替代。- Watch for releases from the Cyberspace Administration (CAC) and the pilot cities’ negative-list catalogs.
请关注国家网信办及试点城市负面清单目录的发布。
Cross-border data: scenario-based, field-level negative lists | 数据跨境场景化、字段级负面清单
Overview
A specific measure in the Action Plan for Stabilizing and Improving Foreign Investment (利用外资固稳促优行动方案) targets cross-border data flows. Issued 16 June 2026 (商资发〔2026〕97号) and effective from 1 July 2026, it supports free-trade zones (FTZs) and service-opening pilot cities in exploring scenario-based, field-level data-export negative lists, and promotes national standards for “important data” identification catalogs across eight industries.
This article explains what changes for foreign-invested enterprises moving data out of China, building on the general cross-border data transfer rules.
Informational guidance only; the exact negative lists and catalogs are issued by the competent authorities and pilot cities, so verify before acting.
What is new
Scenario-based, field-level negative lists
- FTZs and service-opening pilot cities may, in more areas, formulate scenario-based (i.e., by business scenario) and field-level (i.e., down to specific data fields) data-export negative lists.
- A field-level list tells an enterprise precisely which data fields are restricted for export, instead of a broad category ban — reducing uncertainty for compliant transfers.
Important-data catalogs for eight industries
- Promote national standards for important-data identification catalogs in: industrial, telecom, geoinformation, automotive, pharma, seeds, aerospace, and civil aviation.
- Once published, these catalogs define which data is “important data” and therefore subject to stricter cross-border controls.
How it differs from the general rules
- The general PIPL/cybersecurity framework still applies: important/large-volume/sensitive personal data exports follow the standard routes (security assessment, certification, or standard contract).
- The new approach adds a local, granular negative list layer: within an FTZ or pilot city, if your specific scenario and fields are NOT on the negative list, the path can be clearer and faster.
- It is a refinement and localisation, not a repeal, of the existing cross-border data transfer rules.
What to do next
- Map your cross-border data flows by business scenario and by specific data field.
- Check whether your FTZ or pilot city has published (or is consulting on) a scenario-based / field-level data-export negative list covering your scenario.
- Determine whether your industry’s “important data” catalog (when issued) classifies your data as important.
- If not on a negative list and not “important data”, document the basis and proceed under the applicable streamlined route.
- Where uncertainty remains, use the standard statutory route (assessment / certification / standard contract) and consult the local cyberspace authority.
- Keep records; negative lists and catalogs are expected to be updated iteratively.
Sources
- 中华人民共和国中央人民政府（国务院）— 《利用外资固稳促优行动方案》全文：https://www.gov.cn/zhengce/zhengceku/202606/content_7072838.htm
- 国家互联网信息办公室（官方门户）— https://www.cac.gov.cn
- 商务部 — 关于印发《利用外资固稳促优行动方案》的通知（商资发〔2026〕97号）：https://tradeinservices.mofcom.gov.cn/article/zcfb/zcfg/202606/183553.html
Related reading
- see also: Cross-border data transfer rules (PIPL) / 跨境数据传输规则（个保法）
- see also: PIPL compliance for foreign companies / 外资企业个人信息保护法合规
- see also: Stabilizing Foreign Investment Action Plan: 15 measures at a glance / 利用外资固稳促优行动方案：15条举措总览
数据跨境场景化、字段级负面清单
概述
《利用外资固稳促优行动方案》中的一项具体举措指向数据跨境流动。方案于2026年6月16日印发（商资发〔2026〕97号），自2026年7月1日起落地，支持自由贸易试验区、服务业扩大开放试点城市探索场景化、字段级数据出境负面清单，并推动八个行业“重要数据”识别目录国家标准制定。
本文在一般跨境数据传输规则之上，说明外资企业数据出境有何变化。
本文仅为信息性指引；具体负面清单与目录由主管机关及试点城市发布，行动前请核实。
新在何处
场景化、字段级负面清单
- 自贸区与服务业扩大开放试点城市可在更多领域制定场景化（按业务场景）与字段级（细化至具体数据字段）的数据出境负面清单。
- 字段级清单精确告知企业哪些数据字段受限出境，而非笼统类别禁止，降低合规传输的不确定性。
八行业重要数据目录
- 推动工业、电信、地理信息、汽车、医药、种业、航天、民航等八个行业领域重要数据识别目录国家标准制定。
- 目录发布后，将界定何为”重要数据”，从而适用更严格的跨境管控。
与一般规则的区别
- 个保法/网络安全一般框架仍然适用：重要、大体量或敏感个人信息出境走标准路径（安全评估、认证或标准合同）。
- 新方案增加了一层地方、细粒度负面清单：在自贸区或试点城市内，若具体场景与字段不在负面清单上，路径可更清晰、更快。
- 这是对现有跨境数据传输规则的细化与本地化，而非废止。
下一步建议
- 按业务场景与具体数据字段梳理跨境数据流。
- 核查所在自贸区或试点城市是否已发布（或正征求意见）覆盖你方场景的场景化/字段级数据出境负面清单。
- 判断所在行业”重要数据”目录（发布后）是否将你方数据列为重要数据。
- 若不在负面清单且非”重要数据”，留存依据并按适用的简化路径办理。
- 仍有不确定时，走法定标准路径（评估/认证/标准合同）并咨询地方网信部门。
- 保留记录；负面清单与目录预计将迭代更新。
来源
- 中华人民共和国中央人民政府（国务院）— 《利用外资固稳促优行动方案》全文：https://www.gov.cn/zhengce/zhengceku/202606/content_7072838.htm
- 国家互联网信息办公室（官方门户）— https://www.cac.gov.cn
- 商务部 — 关于印发《利用外资固稳促优行动方案》的通知（商资发〔2026〕97号）：https://tradeinservices.mofcom.gov.cn/article/zcfb/zcfg/202606/183553.html
相关阅读
- see also: 跨境数据传输规则（个保法） / Cross-border data transfer rules (PIPL)
- see also: 外资企业个人信息保护法合规 / PIPL compliance for foreign companies
- see also: 利用外资固稳促优行动方案：15条举措总览 / Stabilizing Foreign Investment Action Plan: 15 measures at a glance