China's cyberspace regulator, together with two other ministries, has issued the Network Data Security Risk Assessment Measures.
For cross-border businesses operating in or with China, this is not a footnote — it's a structural shift in how data compliance gets done.
Who is in scope?
Two main categories: handlers of "important data" and operators of critical information infrastructure. Ordinary consumer apps may not automatically qualify, but once your data — aggregated — reveals patterns about populations, supply chains, infrastructure, or sensitive industries, you should assume scrutiny.
What does the assessment actually cover?
Four layers in practice:
- Data itself: classification and sensitivity grading
- Processing activities: collection, storage, use, sharing, cross-border transfer
- Security controls: encryption, access logs, incident response
- Risk closure: remediation pathway when issues are found
Why cross-border firms should pay closer attention
Cross-border data transfer is flagged as a priority assessment scenario. This overlays the existing security assessment, standard contract, and certification routes already in place. The practical shift: annual review will become the norm, not a one-time filing.
Three things to do this quarter
- Internal data asset inventory — fields, purposes, locations.
- Cross-border data flow map — every route, every legal basis.
- Consolidate your security policies into a "draft assessment report" — something you can hand to a regulator on request.
Most clients I advise hit the same wall first: business teams cannot articulate where the data actually travels. Legal work is the second step. Mapping is the first.
If your company is restructuring its China data posture or planning outbound investment with data dependencies, happy to compare notes.
Specific cross-border treatment should be confirmed against the law in force and local counsel where applicable.
#CrossBorderLaw #DataCompliance #ChinaLaw #InternationalLawyer #AILawyer
———
Mike Wu, China-licensed Attorney · Cross-border practice
4 languages (CN/EN/ES/JA)
Site: wzklaw.com/contact.php?source=linkedin · Book consultation: wzklaw.com/contact.php?source=linkedin