China says data export review rules for companies that have sent the personal info of 100K+ users abroad since January 1, 2021, go into effect on September 1
Context & Ripple Effects
This September 1 deadline is the third layer of a stack Beijing has been building since mid-2021: the personal information protection law passed in August 2021 set consent and minimum-scope requirements for collection, while the regulator separately required any company holding data on more than a million users to clear a security review before an overseas share listing.
What is new here is the retrospective scope — any company that has already moved personal data on 100,000-plus users abroad since January 1, 2021 falls under review, not just future transfers. The direction of travel continued with guidelines imposing strict review of cross-border transfers and foreign-capital M&A that December, before Beijing partially reversed course by exempting trade and transport data from export reviews in March 2024.
First-order effects
- Multinationals and Chinese platforms that exported personal data on 100,000-plus users since January 2021 must now pass a government security review before continuing those flows, turning past routine transfers into pending compliance cases.
- Compliance teams face a hard September 1 cutoff to inventory historical transfers and file for review, with continued cross-border operations contingent on approval.
Second-order effects
- Foreign-operated businesses shift toward keeping user data inside China — local storage and in-country processing — because exporting triggers review, which advantages domestic cloud and data-center providers over cross-border architectures.
- The 100,000-user threshold becomes a planning constraint on product launches: services designed to keep Chinese-user datasets below it can avoid the review pipeline entirely.
Third-order effects
- If the pattern holds, data-export review functions less as a fixed rule than as a calibrated lever — tightened through late 2022, then selectively relaxed for trade and transport data in 2024 — letting Beijing modulate openness with economic conditions.
- The cumulative effect is a structural split of the internet along national data perimeters, where operating in China means accepting state gatekeeping over every cross-border flow of personal information.
The trend: China is building a state-controlled checkpoint system for cross-border personal data, one whose stringency oscillates between crackdown and selective exemption rather than settling at either pole.