The Shanghai Whitelist Pilot for Data Transfers

June 12, 2024 | BY

Susan Mok

Philip Qu and Qiuchen Wang from TransAsia Lawyers analyze a pioneering approach to regulating cross-border data transfers recently adopted in one of Shanghai's free trade zones

Summary


  • The cross-border transfer of data is a key issue for many companies operating in China, with many facing a significant compliance burden as a result of complex regulatory requirements
  • Regional deregulation is being trialed in the Lingang Special Area in Shanghai, based on whitelists with a scenario-based approach
  • The whitelist applies only to three specific sectors (biomedicine, intelligent connected vehicles, and mutual funds) although this will impact a number of international companies
  • The trial may set a precedent for other sectors

Cross-border data transfers ("CBDTs") have become a critical compliance concern for multinational companies in China, including Chinese companies with a global footprint. To address some of the inefficiencies that CBDT compliance requirements have introduced, China is now trialing regional deregulation in free trade zones ("FTZs"). One of the more notable recent developments is the testing of a whitelist approach by the Shanghai FTZ, similar to the whitelist approach seen under the GDPR.

On May 17, 2024, the Shanghai FTZ Lingang Special Area released the first three trial lists (collectively, the "Lingang Whitelists") identifying data types that will be subject to reduced cross-border data transfer restrictions. The lists apply to the data generated in three specific industries, as follows:

  • The whitelist for Biomedicine Industries(中国(上海)自由贸易试验区临港新片区生物医药领域数据跨境场景化一般数据清单(试行));
  • The whitelist for Intelligent Connected Vehicles(中国(上海)自由贸易试验区临港新片区智能网联汽车领域数据跨境场景化一般数据清单(试行)); and
  • The whitelist for Mutual Funds (中国(上海)自由贸易试验区临港新片区公募基金领域数据跨境场景化一般数据清单(试行)).

Overall, the Lingang Whitelists are intended to identify data that may be freely transferred out of China if the company fulfills certain corresponding filling procedures and data management requirements. This move brings further clarity on cross-border data transfer compliance work, and is part of a series of regulatory adjustments by the central and local Chinese governments aimed at increasing foreign investment in China.

This premium content is reserved for
China Law & Practice Subscribers.

  • A database of over 3,000 essential documents including key PRC legislation translated into English
  • A choice of newsletters to alert you to changes affecting your business including sector specific updates
  • Premium access to the mobile optimized site for timely analysis that guides you through China's ever-changing business environment
For enterprise-wide or corporate enquiries, please contact our experienced Sales Professionals at +44 (0)203 868 7546 or [email protected]