Shanghai extends negative list policy for outbound data transfers citywide

Shanghai released trial measures for managing the negative list for outbound data transfers on April 24, extending the policy from the China (Shanghai) Pilot Free Trade Zone and the Lin-gang Special Area to the entire city.

First introduced in February 2025 for the Shanghai FTZ and the Lin-gang Special Area, the negative list now also applies to Shanghai's area under the national comprehensive pilot program for expanding opening-up in the service sector.

Under the negative list framework, specific data scenarios and items are identified as requiring compliance procedures for outbound data transfers. Data not included on the negative list may flow across borders freely and in an orderly manner in accordance with the law, without the need for additional filings or declarations.

The newly released negative list covers four key sectors: reinsurance, international shipping, trade and commerce, and meteorology. It encompasses nine specific application scenarios, 29 data subcategories, and 109 data items.

For enterprises, this streamlines outbound data transfer procedures, reducing processing time and compliance costs significantly.

Companies can find detailed information on outbound data transfer policies in the outbound data transfer section of the Government Online-Offline Shanghai website.

Shanghai currently accounts for about 40 percent of China's completed security assessments for outbound data transfers and filings of standard contracts for outbound personal information transfers, ranking first nationwide.

The city is home to nearly 80,000 foreign-funded enterprises and about 1,700 regional headquarters and research and development centers of multinational companies. These organizations rely on cross-border data flows for market analysis, product development, and customer service.

According to the Cyberspace Administration of China, Shanghai may also refer to and apply officially released negative lists for outbound data transfers issued by other eligible regions.

The Shanghai Cyberspace Administration will continue to assess industry demand and work with more sector regulators to develop additional negative lists for outbound data transfers.

The negative list system is set to become a key pillar for Shanghai as the city balances data security with high-level opening-up and high-quality development.

Sources: Shanghai Observer, VCG