“Important data” is a concept unique to China law. It refers to data relating to specific topics, groups, or regions, or data that reaches a certain level of precision and scale, the tampering, destruction, leakage or illegal acquisition or use of which may directly jeopardize national security, economic operations, social stability, public health or safety.

The statutory definition is notoriously broad. Various industry regulators have attempted to provide further guidance through industry-specific classification and grading standards, covering areas such as automotive, civil aviation, energy, healthcare, financial services, geolocation information and highway and waterway transportation, among others. However, these standards largely remain at a high level, offering classification frameworks and general principles rather than concrete, item-by-item criteria that companies can directly reference to determine whether a specific piece of data constitutes important data.

That picture is beginning to change. Recently, a number of China’s free trade zones (FTZs) have published data export negative lists. While these lists were developed in the context of cross-border data transfer, i.e. specifying the administrative filings or approvals required before certain data can leave China, they represent the clearest and most actionable guidance to date on what constitutes “important data” across a wide range of industries.

Some FTZs have published lists with broad, multi-industry coverage. For example:

• Beijing’s list spans nine industries: automotive, pharmaceuticals, civil aviation, retail and services, AI training data, medical devices, autonomous driving, trade logistics and banking.
  
• Tianjin takes a different structural approach, organizing its list not by industry but by cross-cutting thematic categories: strategic commodities, natural resources, industrial manufacturing, finance, statistics, telecommunications, housing, transportation, public health, public safety, internet services and science & technology.

Other FTZs have focused on industries that reflect their regional economic strengths. For example:

• Shanghai’s list addresses reinsurance, international shipping, commerce (retail, food & beverage, and hospitality) and meteorology — sectors closely tied to Shanghai’s role as a global financial and logistics hub.
  
• Hainan, leveraging its unique free trade port status and a major tourist destination, covers deep-sea, aerospace, the seed industry, tourism and duty-free retail.
  
• Chongqing, a major automotive manufacturing base, focuses on the automotive sector with particular emphasis on intelligent connected vehicles.
  
• Zhejiang addresses B2B e-commerce and clearing & settlement—sectors aligned with its thriving digital commerce ecosystem.

What makes these lists particularly valuable is their structure. Each important data entry is defined by two elements working together:

• a data category, which identifies the type or category of data; and
  
• a basic characteristic and description, which sets out the specific conditions, thresholds, and contextual features that must be satisfied for data of that type to qualify as important data.

This two-part structure provides companies with a workable assessment framework that was largely absent from prior guidance.

One of the most notable features of these lists is that important data is not confined to traditionally sensitive sectors. The Guangxi list, for example:

• covers cross-border livestream e-commerce, an industry that many companies would consider routine commercial activity, and identifies as important data any content that reflects “China’s linguistic, historical, cultural customs and national values,” as well as undisclosed statistical data and trade secrets of key enterprises that may appear in livestream scripts or training materials; and

• classifies certain data in the enterprise credit information services sector as important data. Data collected through financial credit checks, commercial due diligence, M&A assessments, ESG ratings that reflect macroeconomic or key-industry operating conditions, industrial competitiveness or supply chain capabilities is expressly covered. On this basis, professional services firms, credit agencies and data analytics providers engaged in everyday business intelligence activities may be processing important data without realizing it.

Although the negative lists are formally limited to FTZ-registered entities conducting cross-border data transfers, the underlying logic – that is, the data categories, qualifying thresholds, and descriptive criteria – may indicate broader national-level regulatory thinking. There is a possibility that these lists will influence how industry regulators across China approach important data identification in the future. 

Under the current regulatory framework, companies are expected to self-identify whether they process important data and report their findings to the competent authorities. This is a consequential step. Once a regulator concurs with a company’s identification, a cascade of strict obligations follows. The company must, among other things:

• process important data using information systems rated at Multi-Level Protection Scheme (MLPS) Level 3 or above;

• conduct annual data security audits and report the results to the authorities; and

• obtain approval from both the data regulator and the relevant industry regulator before transferring important data outside of China.

Given these significant consequences, companies should exercise caution before formally reporting to the authorities. However, waiting passively is no longer a prudent strategy either. The FTZ negative lists have made it possible for the first time to conduct a meaningful, data-item-level internal mapping exercise to identify data that may constitute important data, and to build compliance infrastructure and governance frameworks proactively, in advance of any formal reporting decision.