China: Zhejiang provincial authorities issued trial rules and 2024 negative list for cross-border data transfers in the Free Trade Zone

On 31 March 2025, the Zhejiang Provincial Internet Information Office, Zhejiang Provincial Department of Commerce, and Zhejiang Provincial Data Bureau issued the Administrative Measures for the Negative List of Data Cross-Border Transmission in the China (Zhejiang) Pilot Free Trade Zone (Trial) along with the accompanying China (Zhejiang) Pilot Free Trade Zone Data Outbound Management List (Negative List) (2024 Edition). The framework governs the cross-border provision of personal information and important data in designated sectors such as business-to-business e-commerce and clearing and settlement. Under the framework, data processors must undergo a security assessment when outbound transfers within a calendar year involve the personal information of 5 million or more individuals, the sensitive personal information of 2 million or more individuals, or other volumes that meet specified thresholds outside exempted scenarios. For outbound transfers below these thresholds but still deemed significant, data processors are required to complete the standard contract filing procedure or obtain certification for personal information protection. Exemptions apply to circumstances covered under Articles 3, 4, 5(1)(1) to (3), and 6 of the Provisions on Promoting and Regulating Cross-Border Data Flow. Data processors within the pilot free trade zone must submit applications through their respective sub-zones, complete filing procedures, and comply with dynamic adjustments to the Negative List under the oversight of provincial authorities.