Xiamen’s International Data Centre Measures: Cross-Border Lines, Data Classification and the Circuit Breaker
- Five Xiamen municipal bodies issued the Trial Measures for the Administration of International Data Centres (Xia Shu Ju Gui [2026] No. 1) on 20 October 2026; they take effect on 25 November 2026 and remain valid for two years.
厦门市五个市级部门于 2026 年 10 月 20 日印发《厦门市国际数据中心管理办法（试行）》（厦数据规〔2026〕1 号），自 2026 年 11 月 25 日起试行，有效期 2 年。
- Only market entities registered and actually operating in Xiamen may build, operate or use the facility, and cross-border flow, regulatory audit and substantive compliance responsibility all rest with that local entity.
只有登记注册并实际运营在厦门市的市场主体才能建设、运营或使用该设施，跨境数据流动、监管审计与合规主体责任均由该本地主体承担。
- Connectivity must run through a basic telecommunications operator’s dedicated cross-border link and an international gateway approved by the Ministry of Industry and Information Technology; private networks, tunnelling and unlicensed lines are prohibited.
跨境连通必须经由基础电信运营企业的跨境专用通信链路，并通过工业和信息化部批准的国际通信出入口局；私自架设虚拟专用网络、隧道技术或非法专线均被禁止。
- Data must be classified and graded; exports of important data and of personal information above the assessment threshold still require a data export security assessment, and data subject to domestic storage rules may not leave over the link.
数据须分类分级；重要数据出境以及达到申报门槛的个人信息出境仍须通过数据出境安全评估，要求境内存储的数据不得经该链路出境。
- A circuit breaker lets the telecommunications authority cut the link on four defined triggers, with resumption only after rectification and approval.
业务熔断机制允许电信主管部门在四类情形下切断链路，且仅在整改完成并经批准后方可恢复。
- Eight business formats are cultivated, of which multinational internal management, overseas data processing, cross-border e-commerce and cross-border settlement map most directly onto existing foreign-invested operations.
办法培育八类业态，其中跨国企业内部管理、来数加工、跨境电商与跨境结算与现有外资企业业务重合度最高。
Xiamen’s International Data Centre Measures: Cross-Border Lines, Data Classification and the Circuit Breaker | 厦门市国际数据中心管理办法（试行）：跨境专线、数据分类与业务熔断
Overview
On 20 October 2026 five Xiamen municipal bodies issued the Trial Measures for the Administration of International Data Centres (Xia Shu Ju Gui [2026] No. 1): the Xiamen Municipal Data Administration, the Office of the Committee for Comprehensively Deepening Reform of the CPC Xiamen Municipal Committee, the Office of the Cyberspace Affairs Commission of the CPC Xiamen Municipal Committee, the Xiamen Municipal Communications Administration and the Xiamen Airport Economic Zone Headquarters. The measures take effect on 25 November 2026 and remain valid for two years.
They rest on five instruments: the State Council reply on piloting market-based allocation of production factors, the State Council General Office opinion on trade in services, Xiamen’s services-sector pilot plan, the Provisions on Promoting and Regulating Cross-Border Data Flows, and the Xiamen Special Economic Zone Data Regulations.
The question foreign companies ask is whether one dedicated line can join their operations inside and outside China. The measures answer it in three layers, and the answer is no at each unless the conditions are met separately.
What the measures establish
Article 2 fixes the perimeter. The measures apply to market entities registered and actually operating in Xiamen that build, operate or manage an international data centre, and to the whole of the international data business conducted on that infrastructure. Cross-border data flow, regulatory audit and the substantive compliance responsibility all sit with the locally registered market entity. A group therefore cannot hold the infrastructure in one entity, the traffic in a second and the liability in a third offshore.
Articles 4 and 5 define the two operative terms. An “international data centre” is a facility whose cross-border connectivity is provided by a basic telecommunications operator through a dedicated cross-border communications link, with network security isolation in place, connected internationally through an international communications gateway station approved by the Ministry of Industry and Information Technology, and which maintains a central equipment room and provides server hosting, cloud services and computing power services in a unified way. “International data business” means the collection, storage, processing and governance of overseas data using the international data line on that infrastructure.
Read together, the definitions close a door that had been left ajar: the centre is not a general-purpose exit.
Layer one: the infrastructure
Article 14 is the operational core. Construction and operation must meet national and industry technical standards, and the operator needs a telecommunications business operating licence and the associated qualifications. International data business must be accessed through the dedicated cross-border link provided by a basic telecommunications operator. Private connection to overseas nodes through virtual private networks, tunnelling technology or illegally operated international leased lines is expressly prohibited.
For a foreign group this removes the grey route entirely. An encrypted tunnel between a Shanghai office and a Singapore cloud region, or capacity bought from a reseller holding no international line licence, is not a tolerated practice that the measures now formalise. It is named as prohibited.
Layer two: the data
Article 15 sets the data-side conditions, and they are cumulative rather than alternative.
Data must be classified and graded according to national and industry standards. The export of important data, and the export of personal information that meets the threshold for a data export security assessment, must pass that assessment. Data that laws and regulations require to be stored within China must not flow directly abroad over the dedicated link. Cross-border transmission must use encryption technology and protocols meeting national cryptography management requirements.
The practical consequence is that the dedicated line changes the transport, not the permission. A company that would have needed a security assessment for a transfer before these measures came into force still needs one afterwards. The difference is that an assessment, once passed, can be implemented over a lawful link rather than an improvised one. The category of the data determines the route, and the route does not upgrade the category.
Layer three: liability and the circuit breaker
The measures adopt an allocation formula: whoever builds and operates is responsible, and whoever uses is responsible. Failure to honour a commitment, where it results in a data breach or another security incident or in other non-compliance, allows the regulator to suspend or terminate the relevant operations and to require rectification.
Alongside suspension sits a circuit breaker. Where monitoring identifies cross-border traffic that endangers national security, is suspected of ideological infiltration or of disseminating illegal and harmful information; where an important data breach or a large-scale unlawful outbound transfer of information has occurred or is seriously suspected of having occurred; where a sudden cyber attack or an exploited vulnerability may endanger overall network security; or where another emergency may cause serious consequences — the telecommunications authority issues a link-disposal instruction and the link is cut. Operations resume only after rectification is complete and the regulator has approved resumption.
A cut is an instruction to the link, not a court order and not a fine; it can occur while a commercial dispute is unresolved, and resumption is discretionary as to timing. Any process that depends on continuous cross-border flow should be modelled with an interruption scenario.
The business models the rules name
The measures list eight cultivated formats: data processing for overseas clients, cross-border e-commerce, cross-border settlement, gaming services, distance education, telemedicine, cross-border manufacturing and the internal management of multinational enterprises. Priority goes to international data services, computing power services and cloud services in supply chains and cross-border logistics, BRICS trade-in-services cooperation, cross-Strait integration, and artificial intelligence and large-model training.
For foreign investors, four of the eight map onto operations that already exist. Internal management is the most directly usable: a regional headquarters consolidating finance, human resources and supply-chain planning for Asia can place that workload on the infrastructure, provided the data is not in a category requiring domestic storage and any personal information crossing the threshold has cleared assessment.
Xiamen’s International Data Hub, a State Council-approved project, opened the hub and its international data service centre at the Emerging Science and Innovation Industrial Park in the Airport Economic Zone on 14 September 2026. That site is the physical referent for these rules. An operating coordination mechanism draws in the cyberspace affairs, data, communications administration, development and reform, industry and information technology, commerce, foreign affairs and public security departments, with the pilot park’s management body handling policy implementation, public services, factor guarantees, application scenarios, industry development and project attraction, and an international data service centre operating on a government-guided, park-managed, market-entity-operated basis.
Implications for foreign companies
Three checks, in order. First, is the contracting entity registered and actually operating in Xiamen? If the contract sits with a Hong Kong or Singapore entity, the measures do not apply and its cross-border flow is governed by the general regime. Second, is connectivity contracted with a basic telecommunications operator and terminated at an approved gateway? If not, the arrangement is on the prohibited list whatever its technical merits. Third, has the data been classified, and does any part require assessment or domestic storage? If yes, the line is available only for the portion that clears it.
The official reading is direct. The responsible official of the Xiamen Municipal Data Administration, as reported by Xiamen Daily, stated that an international data centre is not a channel that bypasses existing rules and lets all data leave freely, and that enterprises must still perform their compliance obligations according to data type, business scenario and the relevant law.
Sources
- 厦门市数据管理局等五部门·关于印发《厦门市国际数据中心管理办法（试行）》的通知（厦数据规〔2026〕1号，2026-10-20印发），含办法全文：https://as.xm.gov.cn/zwgk/zfxx/zc/xzgfxwj/202610/t20261022_3022410.htm
- 厦门市人民政府·政务公开（厦门市数据管理局政策文件发布栏目）：https://www.xm.gov.cn/
- 厦门网（厦门日报）·《厦门市国际数据中心管理办法（试行）》印发（2026-10-20），转载办法全文：https://www.xmnn.cn/news/xmxw/202610/t20261024_457606.html
- 厦门网·厦门市国际数据枢纽港与金砖创新基地建设（2026-10-13）：https://www.xmnn.cn/news/xmxw/202610/t20261013_455584.html
厦门市国际数据中心管理办法（试行）：跨境专线、数据分类与业务熔断
概述
2026 年 10 月 20 日，厦门市数据管理局、中共厦门市委全面深化改革委员会办公室、中共厦门市委网络安全和信息化委员会办公室、厦门市通信管理局、厦门临空经济片区指挥部五个市级部门联合印发《厦门市国际数据中心管理办法（试行）》，文号为厦数据规〔2026〕1 号。办法自 2026 年 11 月 25 日起试行，有效期 2 年。
依据为五份文件：国务院关于部分地区要素市场化配置综合改革试点的批复、国务院办公厅关于以高水平开放推动服务贸易高质量发展的意见、《厦门市服务业扩大开放综合试点实施方案》《促进和规范数据跨境流动规定》以及《厦门经济特区数据条例》。
外资企业关心的问题是：能否用一条专线把境内外的业务打通。办法的答案分三层，每层的答案都是”不能”，除非各层条件分别满足。
办法确立了哪些规则
第二条划定适用范围：在厦门市登记注册并实际运营的市场主体，开展国际数据中心建设、运营、管理，以及依托该基础设施从事国际数据业务的全部活动。跨境数据流动、监管审计以及合规主体责任，均由厦门本地注册的市场主体承担。这意味着一个集团不能把基础设施放在一个主体、把流量放在第二个主体、把责任放在境外的第三个主体。
第四条与第五条界定两个核心概念。”国际数据中心”，指由基础电信运营企业提供跨境专用通信链路、落实网络安全隔离、经工业和信息化部批准的国际通信出入口局实现跨境连通，建有中心机房并统一提供服务器架设、云服务及算力服务的设施。”国际数据业务”，指依托国际数据中心、利用国际数据专线，对境外数据提供收集、存储、加工、治理等服务。
两条定义合起来读，等于把一扇原本半开的门关上了：这个中心不是一条通用出口。
第一层：基础设施
第十四条是操作层面的核心。建设运营须符合国家及行业技术标准，并需具备电信业务经营许可证及相关资质。国际数据业务必须通过基础电信运营企业提供的跨境专用通信链路接入。私自通过虚拟专用网络、隧道技术或非法经营的国际专线连接海外节点，被明令禁止。
对跨国集团而言，这一条把灰色路径整体移除了。在上海办公室与新加坡云区域之间自建加密隧道，或向并不持有国际专线牌照的转售商购买带宽，并非办法予以默许、随后加以规范的实践，而是被直接列为禁止事项。
第二层：数据
第十五条设定数据侧的条件，且这些条件累加适用，不能相互替代。
数据须按国家及行业标准分类分级。重要数据出境，以及符合应当申报数据出境安全评估条件的个人信息出境，必须通过数据出境安全评估。法律法规要求境内存储的数据，严禁通过跨境专用链路直接流向境外。跨境传输应采用符合国家密码管理要求的加密技术和协议。
实务上的结论是：专线改变的是传输方式，不是许可本身。在办法出台之前需要做安全评估的传输，在办法出台之后仍然需要。区别只在于，评估通过之后，可以落在一条合法链路上实施，而不是靠临时搭起来的通道。数据的类别决定走哪条路，路径不会反过来提升数据的类别。
第三层：责任与熔断
办法采用一条归责公式：谁建设运营谁负责，谁使用谁负责。未履行承诺造成数据泄露等安全事件或其他违规的，监管部门可暂停或终止相关运营活动，并要求整改。
与暂停并列的是业务熔断机制。监测到跨境流量存在危害国家安全、涉嫌意识形态渗透或传播违法有害信息；发生或重大涉嫌发生重要数据泄露、大规模信息非法出境；突发网络攻击或漏洞被恶意利用且可能危及整体网络安全；或其他可能引发严重后果的紧急状态——出现上述情形之一，由电信主管部门依法下达链路处置指令，执行熔断。整改完成并报经监管部门批准后，方可恢复。
熔断是对链路下达的指令，不是法院裁定，也不是罚款。它可能在一项商业争议尚未解决时发生，恢复时点由监管部门裁量。任何依赖持续跨境流动的流程，都应按中断场景建模。
办法点名的业态
办法列出八类培育业态：来数加工、跨境电商、跨境结算、游戏服务、远程教育、远程医疗、跨境制造、跨国企业内部管理。重点发展供应链与跨境物流、金砖国家服务贸易合作、两岸融合发展，以及人工智能与大模型训练等领域的国际数据服务、算力服务及云服务。
对外资企业而言，八类之中有四类与既有业务直接重合。跨国企业内部管理最易落地：一个负责亚洲财务、人力资源与供应链计划的区域总部，可以把这部分工作负载放到该基础设施上，前提是所涉数据不属于要求境内存储的类别，且跨境部分中的个人信息已通过评估。
厦门国际数据枢纽港为国务院批复项目，2026 年 9 月 14 日在厦门临空经济片区新兴科创产业园揭牌国际数据枢纽港暨国际数据服务中心，即上述规则对应的物理场所。运营协调机制由网信、数据、通信管理、发展改革、工业和信息化、商务、外办、公安等部门按职责分工推进，试点园区管理机构负责政策实施、公共服务、要素保障、场景应用、产业发展与项目招引，并建立”政府引导、园区管理、市场主体运营”的国际数据服务中心。
对外资企业的实务意义
按顺序做三项核查。第一，签约主体是否在厦门登记注册并实际运营？如果合同签在香港或新加坡主体名下，办法不适用，其跨境流动适用一般制度。第二，连通是否与基础电信运营企业签约、链路是否终止于获批出入口局？若不是，无论技术方案多么优越，该安排都在禁止清单上。第三，数据是否已完成分类分级，其中是否有部分需要评估或境内存储？若是，专线仅对通过的部分可用。
官方口径同样直接。厦门市数据管理局负责人在接受厦门日报采访时表示，国际数据中心并不是可以绕开现有规定、让所有数据自由出境的通道，企业仍须按数据类型、业务场景和相关法律履行合规义务。
来源
- 厦门市数据管理局·《厦门市国际数据中心管理办法（试行）》印发通知（厦数据规〔2026〕1 号，2026-10-22）：https://as.xm.gov.cn/zwgk/zfxx/zc/xzgfxwj/202610/t20261022_3022410.htm
- 厦门网转厦门日报·办法解读，含”不是绕开规定的通道”表述（2026-10-24）：https://www.xmnn.cn/news/xmxw/202610/t20261024_457606.html
- 腾讯新闻·转载厦门日报解读（2026-10-24）：https://news.qq.com/rain/a/20261024A0669900
- 厦门网·金砖创新基地若干措施，含”深度参与建设厦门国际数据枢纽港”（2026-10-13）：https://www.xmnn.cn/news/xmxw/202610/t20261013_455584.html