Shanghai has expanded its negative list management system for outbound data transfers from the China (Shanghai) Pilot Free Trade Zone and the Lin-gang Special Area to the entire city.

The move follows the city's initial negative list, released in February 2025 for the Shanghai FTZ and the Lin-gang Special Area. The newly released negative list under the national comprehensive pilot program for expanding opening-up in the service sector now applies across Shanghai, providing clearer guidance for companies handling cross-border data flows.

Here is what companies need to know.

Q1: What is a negative list for outbound data transfers?

China supports the lawful, orderly, and free flow of data across borders. Under relevant laws and regulations, companies handling outbound data transfers may need to follow one of three main compliance procedures: applying for a security assessment, signing a standard contract for the outbound transfer of personal information, or obtaining personal information protection certification.

These procedures do not apply to all types of data. They primarily concern important data and certain volumes of personal information. General data that does not involve these categories may flow freely across borders in accordance with the law.

In simple terms, the negative list identifies the types of data that must undergo these compliance procedures. Data that falls outside the negative list may be transferred overseas without applying for security assessments, signing standard contracts, or obtaining certification.

Q2: What sectors does Shanghai's negative list cover?

Shanghai's negative list covers four sectors: finance, shipping, trade and commerce, and meteorology. It includes nine specific scenarios, 29 data subcategories, and 109 data items.

Supporting management measures define the scope, management requirements, and departmental responsibilities for implementing the negative list.

Following the principle of "one list formulated in one place and applicable in multiple places", promoted by the Cyberspace Administration of China, Shanghai may also refer to and apply negative lists officially released by other free trade zones, free trade ports, pioneering reform areas, and national pilot areas for expanding service-sector opening-up.

The city has compiled negative lists from nine other provinces and municipalities, covering 22 sectors, including automobiles, pharmaceuticals, and civil aviation, which companies can consult for comparison and reference.

Q3: How can companies access and use the negative list?

The negative list is available for download in the notice published on "网信上海", the official WeChat account of Shanghai's cyberspace authorities, or from the outbound data transfer section of the Government Online-Offline Shanghai website.

To support implementation, Shanghai has established consultation channels in all 16 districts and 19 cross-border data service centers across the city. These centers provide one-stop compliance services for companies handling outbound data transfers.

Shanghai has also introduced a "negative list plus operational guidelines" model. Companies whose outbound data activities fall outside the negative list can follow the operational guidelines to conduct data transfers in a compliant and more efficient manner.

Source: Shanghai Observer