China Data Localization
The cumulative regulatory effect of the PRC Cybersecurity Law (2017), Data Security Law (2021), and Personal Information Protection Law (2021) — jointly prohibiting cross-border export of "important data," PRC-citizen personal information, and state-secret-adjacent data without explicit Cyberspace Administration of China (CAC) review.
Summary
The cumulative regulatory effect of the PRC Cybersecurity Law (2017), Data Security Law (2021), and Personal Information Protection Law (2021) — jointly prohibiting cross-border export of "important data," PRC-citizen personal information, and state-secret-adjacent data without explicit Cyberspace Administration of China (CAC) review.
The PRC-side gravity well. The single biggest reason the index now lists Aliyun OSS, Tencent COS, and Huawei OBS as first-class nodes — workloads inside China are not architecturally portable to non-PRC providers without regulatory work that takes quarters and may simply fail.
- Data localization is not just personal data — "important data" is broad and discretionary, and CAC interpretation has tightened over time.
- "Set up an AWS region in China" does not solve this — AWS China is operated by Sinnet/NWCD as separate legal entities under PRC law, with reduced feature parity.
- Multinational replication strategies that include PRC users typically fork into a PRC-local stack and a global stack, with deliberate non-replication at the boundary.
- Drives Aliyun OSS / Tencent COS / Huawei OBS adoption inside China
enablesEast Data West Computing as the lawful patternscoped_toSovereign Storage, S3, Object Storage
Definition
The cumulative effect of three PRC laws — the Cybersecurity Law (2017), Data Security Law (2021), and Personal Information Protection Law (2021) — that jointly prohibit cross-border export of "important data," personal information of PRC citizens, and any data classified as state-secret-adjacent unless an explicit Cyberspace Administration of China (CAC) security review is passed. In practice this is the regulatory backdrop that makes Aliyun OSS, Tencent COS, and Huawei OBS the only viable storage tier for any AI workload involving Chinese-domiciled users, including most foundation-model training corpora collected inside China.
Connections8
Outbound3
scoped_to3Resources2
Cyberspace Administration of China official text of the Cybersecurity Law (2017) — the foundational PRC law that created the data-localization framework.
Analyst summary of CAC's revised cross-border transfer rules — practical guide for what an "important data" classification requires of an export workflow.