China Automotive Data Security Guidelines 2026 Issued to Regulate Outbound Data Transfer

On February 3, eight Chinese government authorities, including the Ministry of Industry and Information Technology, jointly released the “Security Guidelines for the Outbound Transfer of Automotive Data (Edition 2026)”. The move aims to support orderly cross-border automotive data flows while strengthening security oversight across connected and intelligent vehicle ecosystems.
The China automotive data security guidelines establish a unified compliance framework for automotive data processors, covering personal information, important data, and operational vehicle data. By clarifying obligations and exemptions, the policy seeks to reduce regulatory uncertainty while safeguarding sensitive automotive information.

Scope and Regulatory Framework

The guidelines define their scope of application and outline when outbound data transfer activities are subject to regulatory controls. They detail applicable conditions for security assessments, standard contract mechanisms, and verification processes related to outbound personal information transfer.

Exemptions and Applicable Conditions

Nine specific scenarios are identified where automotive data transfers are exempt from security assessments, standard contracts, and verification requirements. These exemptions are intended to streamline compliant data flows without weakening baseline security expectations for automotive data transfer in China.

Key Requirements for Automotive Data Transfers

Clear criteria are provided to identify important automotive data across core industry activities, including research and development, manufacturing, automated driving, software updates, and connected vehicle operations. This helps companies consistently determine compliance obligations.

Operational and Security Obligations

Automotive data processors must follow standardized procedures covering data identification, submission, and management of outbound data transfer activities. The guidelines also emphasize security protection capabilities, including management systems, technical safeguards, log management, and emergency response mechanisms. By standardizing outbound automotive data governance, the China automotive data security guidelines aim to enhance trust, support innovation, and ensure that cross-border automotive data transfers align with national security and data protection priorities without hindering industry development.