Introduction
With regulations such as the Guidelines on the Security of Vehicle Data Export now in force, compliance for cross-border transfers of vehicle data has become an issue that automakers and suppliers must address. This article sets out the key points on determining whether the rules apply and on filing the required applications.
1. Start with the "Important Data" Determination
Whether vehicle data may leave the country hinges first on identifying which data constitutes "important data". Where important data genuinely needs to be transferred abroad, a security assessment is required. The key determination rules include:
- Data collected from more than 100,000 vehicles operating within China
- More than 2,000 cumulative hours of raw imagery captured in real environments
- More than 10 million raw images
- Involvement in a safety incident rated major or above
- Data from which sensitive areas such as military administrative zones or national defense science, technology and industry units can be inferred
2. Volume Thresholds for Exporting Personal Information
Where an operator other than a critical information infrastructure (CII) operator provides personal information to an overseas recipient — excluding sensitive personal information — cumulatively for 1,000,000 individuals or more, or sensitive personal information for 10,000 individuals or more, it must file for a data export security assessment.
3. The Data Export Filing Process
- Determine the filing entity (a legal person established within China).
- Map out the overall export activity (purpose, scope, method and data items).
- Conduct a self-assessment.
- File with the national cyberspace administration.
4. Special Cases
- Data collected overseas that is transmitted to China for processing and then provided overseas again may be exempt from filing, provided that no personal information or important data originating within China is introduced.
- High-risk vulnerabilities reported through the NVDB-CAVD platform may be exempt from filing for a data export security assessment.
Conclusion
Vehicle data export compliance is essentially a structured process of "identify first, assess second, file third". Establishing data classification and grading together with an export management mechanism in advance can effectively avoid compliance risk.
Need Compliance Support?
Need a compliance assessment for cross-border vehicle data transfer? QinGuard provides end-to-end support for data classification and grading, export assessment and filing.