China Data Localization
The cumulative regulatory effect of the PRC Cybersecurity Law (2017), Data Security Law (2021), and Personal Information Protection Law (2021) — jointly prohibiting cross-border export of "important data," PRC-citizen personal information, and state-secret-adjacent data without explicit Cyberspace Administration of China (CAC) review.
Summary
The cumulative regulatory effect of the PRC Cybersecurity Law (2017), Data Security Law (2021), and Personal Information Protection Law (2021) — jointly prohibiting cross-border export of "important data," PRC-citizen personal information, and state-secret-adjacent data without explicit Cyberspace Administration of China (CAC) review.
The PRC-side gravity well. The single biggest reason the index now lists Aliyun OSS, Tencent COS, and Huawei OBS as first-class nodes — workloads inside China are not architecturally portable to non-PRC providers without regulatory work that takes quarters and may simply fail.
- Data localization is not just personal data — "important data" is broad and discretionary, and CAC interpretation has tightened over time.
- "Set up an AWS region in China" does not solve this — AWS China is operated by Sinnet/NWCD as separate legal entities under PRC law, with reduced feature parity.
- Multinational replication strategies that include PRC users typically fork into a PRC-local stack and a global stack, with deliberate non-replication at the boundary.
- Drives Aliyun OSS / Tencent COS / Huawei OBS adoption inside China
enablesEast Data West Computing as the lawful patternscoped_toSovereign Storage, S3, Object Storage
Definition
The cumulative effect of three PRC laws — the **Cybersecurity Law (2017)**, **Data Security Law (2021)**, and **Personal Information Protection Law (2021)** — that jointly **prohibit cross-border export** of "important data," personal information of PRC citizens, and any data classified as state-secret-adjacent unless an explicit Cyberspace Administration of China (CAC) security review is passed. In practice this is the regulatory backdrop that makes **Aliyun OSS, Tencent COS, and Huawei OBS** the only viable storage tier for any AI workload involving Chinese-domiciled users, including most foundation-model training corpora collected inside China.
Recent developments
- CSL first revision effective January 1, 2026 — penalty ceiling 4× higher. Cybersecurity Law's first revision took effect Jan 1, 2026, achieving coordinated integration with DSL + PIPL. Penalty ceiling raised from RMB 500K (
$70K) to RMB 2M ($280K) for violations causing serious consequences like large-scale data leaks. Per Klealegal — China Data Laws 2026 Key Changes. - Cross-Border Certification Measures finalized — effective Jan 1, 2026. The CAC + SAMR jointly issued cross-border personal-information transfer certification measures on October 14, 2025; effective January 1, 2026. Provides the third compliance pathway alongside Security Assessment + Standard Contractual Clauses. Per China Briefing — Cross-Border Data Transfer Certification.
- National standard GB/T 46068-2025 effective March 1, 2026. Provides the technical certification criteria for the new cross-border-transfer certification pathway. Per Chambers — Data Protection & Privacy 2026 — China.
- CIIO obligations: PI + important data must stay on mainland-China servers. Critical Information Infrastructure Operators (CIIOs) must store all personal information + important data collected/generated during operations on servers physically located in mainland China. Transfers abroad require CAC security assessment. Per Recording Law — China Data Privacy Laws 2026 Guide.
- Security Assessment threshold: 1M PI subjects or 10K sensitive PI subjects per year. Mandatory CAC security assessment for any organization transferring personal information of more than 1M individuals, or sensitive personal information of more than 10K individuals, abroad within a single year. Per California Lawyers Association — Cross-Border Data Transfer in China.
- PIPL has extraterritorial scope. PIPL applies to overseas processing activities targeting individuals in China (products/services or analytics about Chinese individuals). Per DLA Piper — Data Protection Laws of the World: China.
Connections 8
Outbound 3
scoped_to3Resources 2
Cyberspace Administration of China official text of the Cybersecurity Law (2017) — the foundational PRC law that created the data-localization framework.
Analyst summary of CAC's revised cross-border transfer rules — practical guide for what an "important data" classification requires of an export workflow.