Data China Provides Clarity on Data Export—And New Leverage

Related Vendors

Taiwan Machine Tool & Accessory Builders' Association (TMBA)

Wuxi InfiMotion Technology Co., Ltd.

For the first time, there are reasonably clear rules for the export of vehicle data from China. OEMs should breathe a sigh of relief. However, the 27 categories and 51 sub-categories also create new bureaucracy—and areas of attack.

For the first time, China has published reasonably clear rules for the export of data in the automotive industry. This is because the increased networking of vehicles and the global expansion of China's automotive industry is leading to an increase in cross-border data traffic. The Ministry of Industry MIIT and several other authorities published the new "Safety Guidelines for Cross-Border Transfer of Vehicle Data (2026)" at the beginning of February.

Connected driving alone can generate up to 1.4 terabytes of data per hour, which is equivalent to 250 movies on a streaming platform. The data that car manufacturers classify as important and that which they do not, as well as the respective compliance regulations, have now been more clearly defined.

Three Categories of Data

Data for export is divided into three main categories: 

1. Data that is generated in China but then transferred abroad
2. Data stored in China that is accessed or downloaded from abroad, and
3. Personal data of Chinese citizens crossing the border.

The clarifications are likely to come as a relief to many Chinese and foreign OEMs, as little had been explained until now. Nevertheless, as is often the case with well-intentioned initiatives by government agencies, new bureaucracy is being created. Companies must take inventory of their data and sort it according to the above categories. Subsequently, either a security assessment and export license or a standard contract for data transfer is required.

However, there is also a third possibility, whereby the data is exempt from the rules. This applies to most data from the human resources department, among others, while most data from production, software updates, and even customer services is subject to closer scrutiny during export.

Bureaucracy Requires Its Own Representative

For larger companies, this probably means that they will have to employ their own data export officer or train comparable employees accordingly. Anyone who neglects compliance in this area from now on will be vulnerable in the event that China seeks retaliatory measures against the next EU punitive tariffs on Chinese exports or the next import restrictions imposed by Brussels on Chinese goods.

However, the Chinese government and its automotive associations portray the new data traffic rules as a purely positive development that protects consumers and also ensures healthy market growth. The aim here is to achieve “interaction between high-quality economic development and data security at the highest level,” writes the Chinese State Council on its official website.

Tool for Disciplinary Measures

However, it is clear that this creates another instrument for disciplinary measures against individual companies and, if necessary, for export restrictions. German and European companies in China do not need to panic about these new regulations and let their spending on law firms and consulting firms skyrocket. However, they must comply with the new rules in order to avoid becoming easy targets for political harassment.

There are a total of 27 categories of data in the automotive industry. According to their own guidelines, 51 subcategories of these can now be used by the Chinese authorities at any time for more detailed investigations.

After an internal assessment of the data within the company, forms must be completed and the necessary applications submitted to the Chinese regulatory authorities. For the first time, there are now more precise guidelines for this paperwork. From the perspective of car manufacturers and service providers, it is encouraging that the source code for “over-the-air updates” is exempt from the approval requirement under certain circumstances. Data on “security incidents” that have already been properly declared elsewhere may also be freely exported.

Secure Authentication Strategies

Passwordless MFA for Modern Cybersecurity