- China’s free-trade-zone (FTZ) data-export negative-list mechanism is moving from policy design to live, enforceable cases. 自贸试验区数据出境负面清单机制正从制度设计走向可落地的实际案例。
- Beijing, Hengqin (Guangdong), Chongqing and Nansha (Guangzhou) have each recorded its first negative-list data-export case. 北京、横琴（广东）、重庆、南沙（广州）均已出现首单负面清单数据出境案例。
- Beijing’s “Two Zones” negative list (May 2026) adopts a “1+9” design covering 67 business scenarios and 612 data fields across the whole municipality. 北京市”两区”数据出境负面清单（2026年5月）采用”1+9″制度设计，覆盖全市域 67 个业务场景、612 个字段。
- NongHyup Bank Beijing Branch became China’s first banking institution to achieve compliant data export under the negative-list framework on 2026-08-03. 韩国农协银行北京分行于 2026-08-03 成为全国首家通过负面清单实现数据合规出境的银行业机构。
- Hengqin’s list centers on a “use-first, report-later” model with a 15-working-day post-hoc reporting window for qualifying data. 横琴清单核心为”先用后报”，符合条件的企业可便捷出境，并于事后 15 个工作日内报告。
- All published lists are filed and reviewed by the Cyberspace Administration of China (CAC) and the National Data Administration (NDA). 上述清单均经国家网信办、国家数据局审核备案。
FTZ Data-Export Negative Lists Accelerate: Beijing, Hengqin, Chongqing and Nansha Go Live | 自贸试验区数据出境负面清单加速落地：北京、横琴、重庆、南沙首单齐发
Overview
China’s cross-border data governance has entered a new phase in which free-trade zones (FTZs) are permitted to define “negative lists” of data that may NOT be freely exported, while everything else outside the list flows under a lighter, more predictable regime. Throughout 2026 this mechanism shifted decisively from design documents to real, booked cases. Four jurisdictions — Beijing, Hengqin (in Guangdong), Chongqing and Nansha (in Guangzhou) — have each announced a first negative-list data-export case, signalling that the framework is operational rather than aspirational. The confirming authority for the underlying regime, the Cyberspace Administration of China (CAC), together with the National Data Administration (NDA), reviews and files every published list.
Negative-list mechanism
The negative-list approach inverts the traditional burden. Under the older standard-contract filing model, many routine transfers required case-by-case assessment. Under the negative-list model, an enterprise first checks whether its data falls within a listed sensitive category. If it does not, the data can leave in an orderly, secure and freer flow; if it does, the stricter pathways still apply. Each FTZ tailors its list to its local industrial strengths, so the same national principle produces different sector coverage across the country. Lists published so far have appeared in Tianjin, Beijing, Hainan, Shanghai, Zhejiang and Guangdong, among others.
Beijing
Beijing’s “Two Zones” (the integrated national demonstration zone for opening up the service sector and the FTZ) negative list, released in May 2026, follows a “1+9” architecture: one management measure plus nine sector lists, applicable citywide. Building on five previously covered domains, it adds four new ones — medical devices, autonomous driving (intelligent connected vehicles), trade logistics and banking — to reach 67 business scenarios and 612 data fields. The milestone banking case came on 2026-08-03, when NongHyup Bank Beijing Branch (Korea’s NongHyup Bank) became the first banking institution in China to achieve compliant data export under the negative-list framework. Its management mode shifted from standard-contract filing to the secure, orderly free flow enabled by the negative list — a template now watched closely by foreign-invested banks in the Beijing CBD.
Hengqin
Guangdong’s Hengqin FTZ negative list was issued as Yue Wang Ban Fa [2026] No.1 on 2026-05-15, focusing on two sectors: intelligent equipment manufacturing and personal credit reporting services. Its signature feature is “use-first, report-later” (先用后报). An enterprise self-assesses against the list; if its data qualifies, it may export conveniently, then files a report within 15 working days afterward. This reduces upfront friction for manufacturers and credit-service firms while preserving a clear audit trail.
Chongqing
Chongqing’s list — the China (Chongqing) Pilot FTZ Data Export Management List (Negative List) (2025 Edition) — delivered its first beneficiary on 2026-08-11, when Changan Automobile became the first enterprise in the Chongqing FTZ to enjoy the dividends of the negative-list regime. For an automotive exporter, the ability to move R&D and operational data under a predictable negative-list pathway is material to global product development cycles.
Nansha
Nansha, within the Guangzhou portion of the Guangdong FTZ, issued its implementation guide for the data-export negative list on 2026-08-18. The Nansha guide extends coverage to personal credit reporting services and intelligent equipment manufacturing, aligning with the Guangdong provincial direction while providing local implementation detail for enterprises in the Nansha New Area.
Practical steps
For an FDI enterprise weighing the mechanism, the practical sequence is: (1) map your data inventory to the relevant FTZ list by sector and field; (2) confirm whether the data sits outside the listed sensitive categories; (3) if it does, adopt the negative-list pathway and document your self-assessment; (4) where the local rule requires it, complete post-hoc reporting within the statutory window (e.g., 15 working days in Hengqin); (5) keep records defensible, because CAC and NDA review and file every list. Foreign banks, automakers, device makers, logistics and credit-service firms are the earliest movers.
Related reading
The mechanism is part of a broader opening of FTZs and “Two Zones” to foreign investment, with data mobility treated as infrastructure for trade and FDI rather than a pure compliance cost. Enterprises should monitor further list releases from Tianjin, Hainan, Shanghai and Zhejiang, and track CAC guidance for procedural updates.
Legal backbone
The negative-list model is one pillar of China’s three-track cross-border data regime. The backbone instrument is the CAC Provisions on Promoting and Regulating the Cross-Border Data Flows (promulgated in 2024), which, together with the earlier Measures for Data Exit Security Assessment and the Standard Contract Measures, forms a tiered system. The first track is a security assessment for important data and large-volume personal information. The second track is standard-contract filing or certification for routine transfers below the statutory thresholds. The third track is the FTZ negative list, which frees intra-list data from the heavier assessment and filing pathways. For an FDI enterprise, the practical upside is that siting data operations inside an FTZ can convert a transfer that would otherwise require assessment or filing into a self-assessed, list-based flow — provided the data stays outside the listed sensitive categories. The lists themselves remain filed and reviewed by CAC and the NDA, so the lighter pathway is a delegated, not abolished, control. Enterprises should therefore keep both the negative list and the national thresholds in view when designing a cross-border transfer architecture.
自贸试验区数据出境负面清单加速落地：北京、横琴、重庆、南沙首单齐发
概述
我国跨境数据治理已进入新阶段：自贸试验区被允许界定”数据出境负面清单”——即不得自由出境的数据类别，清单之外则适用更轻量、更可预期的管理路径。2026 年以来，这一机制从制度文本走向真实落地的案例。北京、横琴（广东）、重庆、南沙（广州）四个片区均已公布首单负面清单数据出境案例，表明该框架已实际运行而非停留在纸面。作为底层规制的主管部门，国家互联网信息办公室（网信办）与国家数据局对每一份发布的清单进行审核备案。
负面清单机制
负面清单思路颠覆了传统的合规负担逻辑。在过去的标准合同备案模式下，大量常规数据传输需逐案评估；而在负面清单模式下，企业先判断其数据是否落入清单所列的敏感类别。若未落入，数据即可在”安全有序自由流动”的框架下出境；若落入，则仍适用更严格的路径。各自贸试验区结合自身产业优势定制清单，因此同一国家原则在全国呈现不同的行业覆盖。目前天津、北京、海南、上海、浙江、广东等地已相继发布清单。
北京
北京市”两区”（国家服务业扩大开放综合示范区与自贸试验区）数据出境负面清单于 2026 年 5 月发布，采用”1+9″制度设计：1 套管理办法加 9 个领域清单，全市域覆盖。在原有 5 个领域基础上，新增医疗器械、自动驾驶（智能网联汽车）、贸易物流、银行业 4 大领域，覆盖 67 个业务场景、612 个字段。标志性银行业案例出现在 2026-08-03：韩国农协银行北京分行（NongHyup Bank Beijing Branch）成为全国首家通过负面清单实现数据合规出境的银行业机构，其管理模式由标准合同备案转为负面清单框架下的安全有序自由流动，已成为北京 CBD 外资银行重点关注的范本。
横琴
广东自贸试验区横琴片区数据出境负面清单以粤网办发〔2026〕1号于 2026-05-15 发布，聚焦智能装备制造业和个人征信服务业两大领域。其核心特色是”先用后报”：企业对照清单自主研判，符合条件即可便捷出境，并于事后 15 个工作日内报告。这一设计在降低制造企业及征信服务机构前期合规摩擦的同时，保留了清晰的审计痕迹。
重庆
重庆的清单——《中国（重庆）自由贸易试验区数据出境管理清单（负面清单）（2025版）》——于 2026-08-11 迎来首家受益企业：长安汽车成为重庆自贸区首家享负面清单红利企业。对汽车出口企业而言，能在可预期的负面清单路径下移动研发与运营数据，对其全球产品开发周期具有实质意义。
南沙
南沙（中国（广东）自由贸易试验区广州南沙新区片区）于 2026-08-18 发布数据出境负面清单实施指南，将覆盖拓展至个人征信服务业和智能装备制造业，既与广东省方向一致，又为南沙新区企业提供了本地化落地细则。
实务步骤
对于打算运用该机制的外商投资企业，实务顺序为：（1）按行业与字段将数据资产映射到所在片区清单；（2）确认数据是否落在清单所列敏感类别之外；（3）若未落入，即采用负面清单路径并留存自查记录；（4）若当地规则要求，在法定时限内完成事后报告（如横琴为 15 个工作日）；（5）保持记录可抗辩，因为网信办与国家数据局对每份清单实施审核备案。外资银行、车企、设备制造商、物流及征信服务机构是最早的先行者。
延伸阅读
该机制是自贸试验区与”两区”更大范围对外开放的一部分，数据流动被视为贸易与外资的”基础设施”而非单纯的合规成本。企业应关注天津、海南、上海、浙江等地后续清单发布，并跟踪网信办的程序性指引更新。
规制基础
负面清单模式是我国跨境数据”三轨”治理框架的一根支柱。其底层文件是网信办《促进和规范数据跨境流动规定》（2024 年公布），与更早的《数据出境安全评估办法》《个人信息出境标准合同办法》共同构成分层体系。第一轨针对重要数据与大体量个人信息走安全评估；第二轨针对低于法定阈值的常规传输走标准合同备案或认证；第三轨即自贸试验区负面清单，把清单内数据从更重的安全评估与备案路径中解放出来。对外商投资企业而言，务实红利在于：把数据运营布局在自贸试验区内，可使原本需评估或备案的传输转为”清单自检、自由流动”——前提是数据落在清单所列敏感类别之外。清单本身仍由网信办与国家数据局审核备案，因此更轻的路径是”下放”而非”取消”的管控。企业在设计跨境传输架构时，应同时关注负面清单与国家统一阈值两条线。
Sources
- https://com.gd.gov.cn/gkmlpt/content/4/4897/post_4897452.html （广东省商务厅等：《中国（广东）自由贸易试验区数据出境负面清单管理办法（试行）》及管理清单（负面清单）（2025版），粤网办发〔2026〕1号）
- https://english.beijing.gov.cn/latest/news/202608/t20260813_4821506.html （北京市政府：全国首个银行业数据出境负面清单备案落地北京 CBD，2026-08-13）
- https://big5.china.com.cn/gate/big5/zw.china.com.cn/2026-08/07/content_118637480.shtml （新华社/中国网：我国首个银行业数据出境负面清单备案落地北京，2026-08-07）
- https://www.cac.gov.cn/ （国家互联网信息办公室，数据出境相关规制主管部门）