Guangdong’s Greater Bay Area Data Special Zone Work Plan: What Cross-border Data Rules Mean for Foreign Firms (2026)
- Guangdong’s Work Plan for Building the Guangdong-Hong Kong-Macao Greater Bay Area Data Special Zone was drafted and issued by the Guangdong Provincial Government Services and Data Management Bureau and publicly released on 15 September 2026.
《广东省建设粤港澳大湾区数据特区工作方案》由广东省政务服务和数据管理局起草并印发实施，于 2026 年 9 月 15 日公开发布。
- By the end of 2027 the plan aims to make cross-border data flows markedly more standardised, facilitated and large-scale, and to build 50 replicable, promotable key cross-border data scenarios.
方案提出，到 2027 年底，数据跨境规范化、便利化、规模化程度显著提升，打造 50 个可复制、可推广的数据跨境重点场景。
- By the end of 2028 the cross-border data industry is to exceed RMB 200 billion in scale, with value added in related manufacturing and services reaching RMB 1 trillion, helping the Greater Bay Area become the world’s most digitally advanced bay area.
到 2028 年底，数据跨境产业规模超 2000 亿元，数据跨境产业拉动的制造业、服务业等相关产业增加值达万亿元，助力粤港澳大湾区成为全球数字化水平最高的湾区。
- The plan sets five task areas: making full use of special institutional rules, building specific infrastructure, creating characteristic application scenarios, cultivating a service ecosystem, and building international cooperation platforms.
方案部署五方面任务：用好用足特殊制度规则、建设特定基础设施、打造特色应用场景、培育特优服务生态、构建国际合作平台。
- On rules, it deepens application of the Greater Bay Area standard contract for personal information cross-border flow, explores a filing “green channel” and “one filing, multiple uses”, promotes wide application of the data export negative list and explores extending its scope to the entirety of Guangzhou and Shenzhen as national comprehensive pilot cities for opening up the services sector.
规则方面，深化粤港澳大湾区个人信息跨境流动标准合同应用，探索备案”绿色通道”和”一次备案、多次使用”，推动数据出境负面清单广泛应用，探索将其适用范围扩大到广州、深圳国家服务业扩大开放综合试点城市全域。
- The plan deploys nine scenario categories around industry, livelihood and governance — including cross-border diagnosis and treatment, intelligent connected vehicles, transparent cross-border e-commerce, digital RMB and social security services under “Bay Area Connect”.
方案围绕产业、民生、治理部署九类场景，涵盖跨境诊疗、智能网联汽车、跨境电商阳光化、数字人民币、社保服务”湾区通”等。
- The national baseline remains the CAC’s September 2026 Q&A: non-critical-information-infrastructure operators may use a standard contract or certification to export personal information, while larger volumes trigger a mandatory security assessment, and “quantity splitting” to evade assessment is prohibited.
国家层面的边界仍以国家网信办 2026 年 9 月问答为准：非关键信息基础设施运营者可通过标准合同或认证方式出境个人信息，达到更高数量则应当申报安全评估，并禁止以”数量拆分”规避安全评估。
Guangdong’s Greater Bay Area Data Special Zone Work Plan: What Cross-border Data Rules Mean for Foreign Firms (2026) | 广东省粤港澳大湾区数据特区工作方案：跨境数据规则对外资企业的实际影响
Overview
Guangdong has published a work plan to build a data special zone across the Guangdong-Hong Kong-Macao Greater Bay Area. The Work Plan for Building the Guangdong-Hong Kong-Macao Greater Bay Area Data Special Zone was drafted and issued by the Guangdong Provincial Government Services and Data Management Bureau and publicly released on 15 September 2026. It sets quantified targets to the end of 2027 and the end of 2028, organises its measures into five task areas, and leans on two existing instruments — the Greater Bay Area standard contract for personal information cross-border flow and the data export negative list. For foreign firms with data-intensive operations in the region, the plan is best read together with the national threshold rules issued by the Cyberspace Administration of China in September 2026. This article sets out the targets, the five task areas, the national baseline and what it all means in practice.
Targets to 2027 and 2028
The plan sets two milestones. By the end of 2027, cross-border data is to become markedly more standardised, facilitated and large-scale, and 50 replicable, promotable key cross-border data scenarios are to be built. By the end of 2028, the cross-border data industry is to exceed RMB 200 billion in scale, the value added of related manufacturing, services and other industries driven by the cross-border data industry is to reach RMB 1 trillion, and the Greater Bay Area is to be helped to become the bay area with the highest level of digitalisation in the world.
The structure of the targets is telling: the first milestone is about scenarios and process, the second about industrial scale. That sequencing suggests the near-term work is about building usable pathways and reference cases rather than immediately maximising volume.
Five task areas
Special institutional rules
The first task area is to make full use of the special institutional rules. The plan calls for deepening application of the Greater Bay Area standard contract for personal information cross-border flow, and for exploring a filing “green channel” and “one filing, multiple uses”. It also calls for promoting wide application of the data export negative list and for exploring extending that list’s scope to the entirety of Guangzhou and Shenzhen as national comprehensive pilot cities for opening up the services sector. It further calls for developing “Bay Area standards” for digital technology and promoting mutual recognition of rules and standards. The wording matters: the green channel and the multiple-use filing are framed as exploration, not as an operating facility.
Specific infrastructure
The second task area is infrastructure. The plan advances cross-border computing interconnection such as “Hong Kong data, Guangdong computing” and “Macao data, Guangdong computing”; it provides for a provincial blockchain network and a cross-border trusted data space, and explores “space as a service”; and it calls for optimising the cross-border communications hub, including support for basic telecommunications carriers to expand direct optical cables to Hong Kong and Macao.
Characteristic application scenarios
The third task area is scenarios. Around industry, livelihood and governance, the plan deploys nine categories of scenario — data services, healthcare, education, scientific research, manufacturing, trade, finance, facilitation services and collaborative governance. Named examples include processing of inbound data, cross-border diagnosis and treatment, intelligent connected vehicles, transparent cross-border e-commerce, digital RMB and social security services under “Bay Area Connect”. For foreign firms, these are the areas where a cross-border data pathway is most likely to be relevant in day-to-day operations.
Service ecosystem
The fourth task area is the service ecosystem. The plan provides for a data special zone innovation cooperation centre and for cultivating three kinds of ecosystem — compliance and security, circulation and trading, and technical services — with the aim of lowering the threshold for firms to achieve cross-border compliance and to apply data across borders.
International cooperation platforms
The fifth task area is international cooperation. The plan supports Guangzhou (Nansha), Shenzhen (Qianhai and Hetao), Hengqin and Shantou in deepening cross-border data cooperation with countries under the Belt and Road Initiative, Portuguese-speaking countries, and regions such as Southeast Asia and Latin America, each building on its own strengths.
The national baseline: three export paths
The Greater Bay Area plan sits under national rules, and the operative quantitative boundary is set out in the Cyberspace Administration of China’s Questions and Answers on Policies and Regulations for Data Export Security Management (September 2026), released on 11 September 2026. For operators that are not critical information infrastructure operators, where the cumulative volume of personal information provided overseas since 1 January of the year is 100,000 or more but fewer than one million individuals (excluding sensitive personal information), or fewer than 10,000 individuals’ sensitive personal information, the information may be exported by concluding a standard contract or by obtaining personal information export certification. Where the volume reaches one million or more individuals’ personal information (excluding sensitive personal information), or 10,000 or more individuals’ sensitive personal information, a data export security assessment must be filed for. The Q&A also makes clear that “quantity splitting” and similar methods may not be used to evade the security assessment. The Provisions on Promoting and Regulating Cross-border Data Flows remain an upper-level regulation in this area.
In practice, this yields three paths: a standard contract, certification, or a security assessment. Which applies turns on the category and volume of data, and on whether the operator is a critical information infrastructure operator.
What it means for foreign firms
Three practical points follow. First, map your volumes before you design the pathway. Determine whether the personal information you send overseas is sensitive or not, count the cumulative number of individuals since 1 January of the year, and test that figure against the national thresholds; a standard contract or certification is available in the lower band, while the higher band requires a security assessment. Do not split flows to stay under a threshold, because the Q&A expressly prohibits that.
Second, treat the Greater Bay Area facilities as under exploration. The filing “green channel” and “one filing, multiple uses” are described in the plan as things to explore, not as facilities already built or running. Likewise, extending the data export negative list to the entirety of Guangzhou and Shenzhen is framed as something to explore. Firms should therefore plan on the basis of the current standard contract and negative-list arrangements, and track the pilot developments as they are announced, rather than assuming a fast-track filing is already available.
Third, match your sector to the scenarios. Cross-border diagnosis and treatment, intelligent connected vehicles, transparent cross-border e-commerce and finance are among the nine scenario categories named in the plan, and are the areas where a compliant cross-border data pathway is most likely to align with business needs. A foreign firm active in these areas in the Greater Bay Area can use the scenario list as a guide to where the regional policy energy is concentrated.
Sources
- 广东省政务服务和数据管理局《广东省建设粤港澳大湾区数据特区工作方案》解读（2026 年 9 月 15 日公开发布）: https://zfsg.gd.gov.cn/gkmlpt/content/4/4954/post_4954575.html
- 中国经济信息网：广东公开《工作方案》: https://www.cei.cn//defaultsite/s/article/2026/09/16/4b4ff607-9d914745-01a0-a7da8840-42ad_home.html?columnId=4028c7ca-37115425-0137-11560623-0012&referCode=dqyb
- 国家互联网信息办公室（《数据出境安全管理政策法规问答（2026 年 9 月）》发布主体）: https://www.cac.gov.cn/
- 广东省人民政府: https://www.gd.gov.cn/
广东省粤港澳大湾区数据特区工作方案：跨境数据规则对外资企业的实际影响
概述
广东发布了建设粤港澳大湾区数据特区的工作方案。《广东省建设粤港澳大湾区数据特区工作方案》由广东省政务服务和数据管理局起草并印发实施，于 2026 年 9 月 15 日公开发布。方案设定了到 2027 年底与 2028 年底的量化目标，将措施组织为五方面任务，并依托两项现有工具——粤港澳大湾区个人信息跨境流动标准合同与数据出境负面清单。对在区域内从事数据密集业务的外资企业而言，该方案宜与国家网信办 2026 年 9 月发布的量化边界一并阅读。本文说明目标、五方面任务、国家层面基准及其实际含义。
到 2027 年与 2028 年的目标
方案设定两个节点。到 2027 年底，数据跨境规范化、便利化、规模化程度显著提升，打造 50 个可复制、可推广的数据跨境重点场景。到 2028 年底，数据跨境产业规模超 2000 亿元，数据跨境产业拉动的制造业、服务业等相关产业增加值达万亿元，助力粤港澳大湾区成为全球数字化水平最高的湾区。
目标的结构本身透露信息：第一个节点落在场景与流程，第二个落在产业规模。这一顺序表明，近期工作重心在于搭建可用路径与参考案例，而非立即把流量做到最大。
五方面任务
用好用足特殊制度规则
第一方面任务是特殊制度规则。方案提出，深化粤港澳大湾区个人信息跨境流动标准合同应用，探索备案”绿色通道”和”一次备案、多次使用”；推动数据出境负面清单广泛应用，探索将其适用范围扩大到广州、深圳国家服务业扩大开放综合试点城市全域；并研制数字技术”湾区标准”，促进规则标准互认。措辞值得留意：绿色通道与一次备案多次使用被表述为”探索”，而非已运行的设施。
建设特定基础设施
第二方面任务是基础设施。方案推进”港数粤算””澳数粤算”等跨境算力互联互通；建设省区块链网络与跨境可信数据空间，探索”空间即服务”；并优化跨境通信枢纽，支持基础电信企业扩容直连港澳光缆。
打造特色应用场景
第三方面任务是场景。围绕产业、民生、治理，方案部署九类场景——数据服务、医疗、教育、科研、制造、贸易、金融、便利化服务、协同化治理。其中点名的例子包括”来数加工”、跨境诊疗、智能网联汽车、跨境电商阳光化、数字人民币，以及社保服务”湾区通”。对外资企业而言，这些是跨境数据路径最可能与日常经营相关的领域。
培育特优服务生态
第四方面任务是服务生态。方案提出建设数据特区创新合作中心，培育合规安全、流通交易、技术服务三类生态，目标是降低企业跨境合规与应用门槛。
构建国际合作平台
第五方面任务是国际合作。方案支持广州（南沙）、深圳（前海、河套）、横琴、汕头立足各自优势，深化与共建”一带一路”国家、葡语国家，以及东南亚、拉美等地区的跨境数据合作。
国家层面基准：三条出境路径
大湾区方案位于国家规则之下，现行量化边界由国家网信办《数据出境安全管理政策法规问答（2026 年 9 月）》给出，该问答于 2026 年 9 月 11 日发布。对于非关键信息基础设施运营者，自当年 1 月 1 日起累计向境外提供 10 万人以上、不满 100 万人个人信息（不含敏感个人信息），或者不满 1 万人敏感个人信息的，可通过订立标准合同或通过个人信息出境认证方式出境；达到 100 万人以上个人信息（不含敏感个人信息）或 1 万人以上敏感个人信息的，应当申报数据出境安全评估。问答同时明确，不得以”数量拆分”等手段规避安全评估。《促进和规范数据跨境流动规定》在本领域仍属上位规章。
落到实操，这形成三条路径：标准合同、认证、安全评估。适用哪一条，取决于数据的类别与数量，以及运营者是否属于关键信息基础设施运营者。
对外资企业的实际含义
有三点实务结论。第一，先盘清数量，再设计路径。判断拟出境个人信息是否属于敏感个人信息，统计自当年 1 月 1 日起的累计人数，并对照国家量化边界：较低区间可走标准合同或认证，较高区间应当申报安全评估。不要为压低数字而拆分数据流，因为问答明确禁止以”数量拆分”规避安全评估。
第二，把大湾区相关便利设施视为”探索中”。方案将备案”绿色通道”与”一次备案、多次使用”表述为要探索的事项，而非已建成、已运行的设施；将数据出境负面清单适用范围扩大到广州、深圳全域，同样被表述为探索方向。因此，企业宜按现行标准合同与负面清单安排作规划，并跟踪试点进展的公开发布，而不宜假定快速备案通道已经可用。
第三，把行业与场景对上。跨境诊疗、智能网联汽车、跨境电商阳光化与金融属于方案点名的九类场景之一，也是合规跨境数据路径最可能契合业务需求的领域。在大湾区从事上述领域的外资企业，可把场景清单作为判断区域政策着力点的参考。
来源
- 广东省政务服务和数据管理局《广东省建设粤港澳大湾区数据特区工作方案》解读（2026 年 9 月 15 日公开发布）：https://zfsg.gd.gov.cn/gkmlpt/content/4/4954/post_4954575.html
- 中国经济信息网：广东公开《工作方案》：https://www.cei.cn//defaultsite/s/article/2026/09/16/4b4ff607-9d914745-01a0-a7da8840-42ad_home.html?columnId=4028c7ca-37115425-0137-11560623-0012&referCode=dqyb
- 国家互联网信息办公室（《数据出境安全管理政策法规问答（2026 年 9 月）》发布主体）：https://www.cac.gov.cn/
- 广东省人民政府：https://www.gd.gov.cn/