China’s Cross-Border Data Rules and AI Training

The Cyberspace Administration of China’s Provisions on Promoting and Regulating Cross-Border Data Flow took effect on 22 March 2024. They clarify when data processors must apply for a security assessment, use a standard contract, or obtain personal-information protection certification. Data not identified or publicly announced as important data need not be declared important solely for a security assessment. Some specified business, research, and operational transfers without personal information or important data are exempt from these transfer mechanisms. Other limited personal-information exemptions cover certain contractual needs, cross-border HR management, emergencies, and small volumes. For a non-critical-information-infrastructure operator, exporting important data or at least one million people’s non-sensitive personal information, or at least 10,000 people’s sensitive personal information, generally triggers a data-export security assessment, subject to listed exemptions. Exporting 100,000 to fewer than one million people’s non-sensitive personal information, or fewer than 10,000 people’s sensitive personal information, generally requires a standard contract or certification, again subject to the stated exceptions. Critical information infrastructure operators have separate assessment triggers. Free-trade zones may create approved negative lists that affect which transfers require these mechanisms. AI training creates a data-flow question, not a special blanket category. Uploading Chinese personal information to a foreign cloud, sharing training records with an overseas model provider, or allowing an offshore team to access data may involve an outbound transfer. The processor should identify individuals, sensitivity, volume, purpose, recipient, and whether information is important data; then assess PIPL notices, separate consent, impact assessment, and export mechanism obligations. Synthetic or de-identified information is not automatically exempt if reidentification or personal information remains. Keep a transfer inventory tied to datasets, recipients, model-training stages, and subprocessors. Document exemptions and thresholds, check local free-trade-zone lists, and reassess when training expands to new people or data categories. The 2024 rules simplify selected transfers but retain security, personal-information, and contract duties.