Eight Ministries Issue New Rules on Auto Data Cross-Border Transfers, Outlining Nine Exemption Scenarios

Recently, eight government departments—including the Ministry of Industry and Information Technology (MIIT) and the Cyberspace Administration of China (CAC)—jointly issued the "Guidelines on the Security of Automotive Data Cross-border Transfer (2026 Edition)," aiming to facilitate efficient, convenient, and secure cross-border flows of automotive data. The Guidelines clarify the management approaches and applicable conditions for automotive data transfers abroad, outline nine categories of scenarios eligible for exemption, and refine criteria for identifying important data in specific business contexts such as R&D and design, manufacturing, automated driving, software updates, and connected vehicle operations. The document also stipulates that enterprises must, in accordance with the law, conduct security assessments for data exports, enter into standard contracts for personal information transfers abroad, or obtain relevant certifications. Furthermore, it sets forth specific protective requirements concerning management systems, technical safeguards, log management, and emergency response measures, providing guidance to enterprises on conducting compliant data export activities and enhancing overall data security.