Key Takeaways
- Important-data identification is sector- and authority-dependent.
- Some rules are public; other determinations may be notified directly.
- Important data that must be exported is connected to the national security-assessment route.
Important-data identification is not based on one complete public national list. It depends on sector rules, competent-authority requirements and notifications or public releases that confirm particular data as important data.
National Framework
The Data Security Law provides for important-data catalogues by regions and departments under the national classification and grading system. The Network Data Security Regulation connects that framework to identification and reporting by network-data processors.
The May 2025 CAC Q&A explains that authorities are developing sector rules and that some requirements have been published while others may be communicated through meetings, documents or direct notification.
Public Sector Coverage Examples
The Q&A names published examples in:
- industrial data;
- telecommunications data;
- natural-resources and geographic-information data; and
- statistics data.
Automotive-data rules and verified FTZ data-export negative lists add other sectoral or local source layers. Each source has its own scope and should not be generalized beyond that scope.
Notification Matters
Where data is confirmed as important data, the relevant authority should notify the processor or publish the determination. A processor should preserve that evidence and connect it to its classification, protection and export controls.
The Q&A also explains the position where no public sector rule exists and the processor has not been notified. That official explanation should be read carefully and not converted into a general exemption from data-classification work.
Export Consequence
Where important data collected or generated in China must be provided overseas, the official source map connects the activity to the national security-assessment route.
If a processor is later notified or the data is publicly identified as important data, the Q&A says an assessment filing should be made within two months if the export will continue.
Research Record
For each dataset, record:
- the industry and competent authority;
- the public classification or identification source;
- any direct regulator notification;
- the geographic scope;
- whether the dataset is proposed for export;
- the last source-verification date; and
- the route decision and supporting evidence.
Official Source Basis
Last source verification: 2026-07-30. The official Chinese source prevails. This editorial source map is not legal advice.