- Most VIEs sit in data-intensive sectors, so the structure collides directly with China’s cross-border data-export rules administered by the CAC.
多数VIE身处数据密集型行业，因此其结构会直接与国家网信办主管的跨境数据出境规则发生碰撞。- Three lawful export routes exist—security assessment, standard contract, and certification—with thresholds set by the 2024 cross-border data provisions.
现行有三条合法出境路径——安全评估、标准合同与认证，其阈值由2024年跨境数据规定设定。- The 2024 Provisions exempt certain low-risk flows (e.g., cross-border HR and sub-10,000-person transfers) but preserve assessment for important data.
2024年规定豁免了部分低风险流（如跨境人事管理与低于1万人的传输），但保留了针对重要数据的安全评估。- A VIE cannot move data offshore to its listing parent without first determining whether the data is “important data” or large-scale personal information.
VIE在未先判定数据是否属于”重要数据”或大规模个人信息之前，不得向境外上市母公司传输数据。- In 2026, free-trade-zone negative lists for data and the “free flow” pilot continue to localise exemptions, reducing but not eliminating compliance burden.
2026年，自贸区数据负面清单与”自由流动”试点持续推进属地化豁免，减轻了但并未消除合规负担。- VIE groups should map data flows, classify assets, and secure a CAC position before representing data access in offshore filings.
VIE集团应在境外备案中陈述数据访问权限之前，先行梳理数据流、对资产分类并确立网信办口径。
VIE Structures and Cross-Border Data Export Compliance in 2026 | 2026年VIE架构与跨境数据出境合规
Why VIEs Are a Data-Compliance Flashpoint
The VIE structure exists precisely because the operating company holds licences in sectors the Negative List reserves for domestic players—internet content, value-added telecom, online education, and data services. These are exactly the sectors that generate the largest volumes of personal information and, frequently, important data (重要数据). When the offshore listing parent needs visibility into China operations—for consolidated reporting, algorithm training, or group IT—the data must cross the border, and that movement is regulated.
The regulatory stack a VIE must navigate:
- PIPL (Personal Information Protection Law, 个人信息保护法) — governs personal-information export.
- DSL (Data Security Law, 数据安全法) — governs important-data export.
- CSL (Cybersecurity Law, 网络安全法) — network-security baseline and CII obligations.
- CAC rules — the operative export mechanisms.
The Three Export Routes
China’s cross-border data framework, matured through 2022–2024, offers three primary lawful mechanisms. The choice depends on data volume and sensitivity.
| Route | Governing instrument | Typical trigger |
|---|---|---|
| Security assessment | 《数据出境安全评估办法》(effective 1 Sep 2022) | Important data; CII operators; large-scale PI exports |
| Standard contract | 《个人信息出境标准合同办法》(effective 1 Jun 2023) | Routine PI export below assessment thresholds |
| Certification | CAC-recognised certification bodies | Intra-group, recurring PI transfers |
The Provisions on Promoting and Regulating Cross-Border Data Flows (促进和规范数据跨境流动规定), effective 22 March 2024, rationalised the thresholds. Under these provisions:
- A cross-border transfer necessary for HR, finance, or procurement within a multinational group may be exempt where it involves only employees’ personal information.
- Transfers of personal information below 10,000 individuals (and not important data) generally escape the assessment/contract burden, though sensitive PI still attracts requirements.
- Important data remains subject to security assessment regardless of volume.
- Free-trade zones may publish their own negative lists for data export, further tailoring local exemptions.
Important Data: The Decisive Question
For a VIE, the single most consequential determination is whether its datasets constitute important data. There is no single national catalogue; rather, industry regulators and local authorities issue sectoral and regional lists. A VIE in mapping, healthcare, autonomous driving, or large-platform consumer internet should assume heightened scrutiny. Where important data is present, only the security assessment route applies, and the CAC review is substantive.
Practical steps:
- Data mapping. Inventory what leaves China, who receives it offshore, and for what purpose.
- Classification. Separate important data, sensitive personal information, and ordinary personal information.
- Threshold test. Apply the 2024 exemption thresholds.
- Route selection. Assessment vs. standard contract vs. certification.
- Documentation. Filing record, contract, or certification certificate, plus a PI protection impact assessment (个人信息保护影响评估).
VIE-Specific Tensions
The VIE compounds data risk in three ways:
- Control without ownership. The offshore parent controls the VIE by contract, yet the data resides with the onshore licence holder. Exporting that data tests whether the contractual control is sufficient to authorise the transfer.
- Offshore audit and listing disclosure. Listed-group auditors and regulators offshore may demand raw data access, which can conflict with the CAC position.
- Change-of-control fragility. If the VIE contractual chain is challenged, the legal basis for any data-export authorisation resting on it is also weakened.
2026 Direction: Localisation and Pilots
Through 2026, the compliance landscape is shifting toward managed liberalisation:
- FTZ data negative lists. Several free-trade zones have piloted localised negative lists that exempt specified low-risk data categories from assessment, easing the burden for onshore VIEs in those zones.
- “Free flow” demonstration zones. Designated areas test streamlined export for approved enterprises, including some foreign-invested firms.
- Continuity of core thresholds. The 2024 exemption logic remains the national baseline; pilots layer on top rather than replace it.
The directional message for investors: data-export compliance is becoming more navigable, but it is still a gating item for any VIE that promises offshore data access.
Pre-Filing Data Position
Because the CSRC offshore-listing filing now routinely asks about data security (see companion article No. 105), a VIE should secure its CAC position before the filing. That means:
- A documented important-data determination (or a reasoned finding that none applies);
- A chosen and, where required, completed export route;
- A PI protection impact assessment on file;
- Board-level awareness of the residual risk if the CAC later reclassifies data.
2026年VIE架构与跨境数据出境合规
为何VIE是数据合规的焦点
VIE结构之所以存在，正是因为运营公司在负面清单保留给境内主体的行业——互联网内容、增值电信、在线教育及数据服务——持有牌照。而这些行业恰恰产生最大规模的个人信息，且往往涉及重要数据。当境外上市母公司需要了解中国运营情况（用于合并报表、算法训练或集团IT）时，数据必须跨境，而该流动受到监管。
VIE必须应对的监管体系包括：
- 《个人信息保护法》（PIPL） —— 规范个人信息出境。
- 《数据安全法》（DSL） —— 规范重要数据出境。
- 《网络安全法》（CSL） —— 网络安全基线及关键信息基础设施义务。
- 国家网信办规则 —— 具体的出境机制。
三条出境路径
通过2022—2024年逐步成熟的跨境数据框架，提供了三种主要合法机制。选择取决于数据量与敏感度。
| 路径 | 适用规范 | 典型触发情形 |
|---|---|---|
| 安全评估 | 《数据出境安全评估办法》（2022年9月1日施行） | 重要数据；关键信息基础设施运营者；大规模个人信息出境 |
| 标准合同 | 《个人信息出境标准合同办法》（2023年6月1日施行） | 低于评估阈值的常规个人信息出境 |
| 认证 | 网信办认可的认证机构 | 集团内部、重复性个人信息传输 |
自2024年3月22日起施行的《促进和规范数据跨境流动规定》对阈值进行了合理化。依据该规定：
- 跨国集团内部为人事、财务或采购所必需、且仅涉及员工个人信息的跨境传输，可获豁免。
- 低于1万人的个人信息传输（且非重要数据）一般免于评估/合同负担，但敏感个人信息仍受相关要求约束。
- 重要数据无论数量多少，均须接受安全评估。
- 自由贸易区可发布本区数据出境负面清单，进一步因地制宜地设定豁免。
重要数据：决定性判断
对VIE而言，最具 consequential 的判定是其数据集是否构成重要数据。全国并无单一目录，而是由行业监管者与地方主管部门发布行业性与区域性清单。身处地图、医疗健康、自动驾驶或大型消费互联网平台的VIE，应假设将面临更高审查。一旦涉及重要数据，仅能适用安全评估路径，且网信办审查具有实质性。
实务步骤：
- 数据梳理。 盘点何种数据离境、境外接收方及用途。
- 分类。 区分重要数据、敏感个人信息与一般个人信息。
- 阈值测试。 适用2024年豁免阈值。
- 路径选择。 评估、标准合同或认证。
- 文档化。 备案记录、合同或认证证书，外加个人信息保护影响评估。
VIE特有的张力
VIE在三个方面加剧数据风险：
- 控制而无所有权。 境外母公司通过合同控制VIE，但数据留存于境内持牌方。传输该数据，需检验合同控制是否足以授权该传输。
- 境外审计与上市披露。 上市集团的境外审计师与监管者可能要求原始数据访问权限，这可能与网信办口径冲突。
- 控制权变更脆弱性。 若VIE合同链受到挑战，依托其建立的任何数据出境授权之法律基础亦被削弱。
2026年方向：属地化与试点
至2026年，合规图景正向有管理的自由化演进：
- 自贸区数据负面清单。 若干自由贸易区已试点属地化负面清单，将特定低风险数据类别豁免出评估，减轻区内境内VIE的负担。
- “自由流动”示范区。 指定区域为获批企业（含部分外商投资企业）测试 streamlined 出境。
- 核心阈值延续。 2024年豁免逻辑仍是全国基线；试点为叠加层而非替代。
给投资者的方向性结论：数据出境合规正变得更具可操作性，但对于任何承诺境外数据访问的VIE而言，它仍是把关项。
备案前的数据口径
由于证监会境外上市备案现已常规性问及数据安全（见第105篇配套文章），VIE应在备案之前确立其网信办口径。即：
- 一份成文的重要数据判定（或经论证认定不适用）；
- 已选定并在要求时已完成出境路径；
- 备妥个人信息保护影响评估；
- 董事会层面知悉若网信办后续重新分类数据的剩余风险。
Sources
- 国家互联网信息办公室 (CAC) — 《数据出境安全评估办法》（2022年9月1日施行）
- 国家互联网信息办公室 (CAC) — 《个人信息出境标准合同办法》（2023年6月1日施行）
- 国家互联网信息办公室 (CAC) — 《促进和规范数据跨境流动规定》（2024年3月22日施行）
- 全国人大常委会 (NPC Standing Committee) — 《个人信息保护法》《数据安全法》《网络安全法》