Start with the dataset and the competent authority
Important data is not a synonym for confidential business information, sensitive personal information or all data held by a regulated company. The starting point is the applicable sector and regional rules, the characteristics of the dataset, and any designation communicated by the competent authority. One dataset may require both personal-information and important-data controls.
This is a selected source map, not a complete national catalogue or an official determination. The national Q&A date above identifies the baseline explanation, not the publication date of every instrument below. The underlying sector texts were checked on 14 September 2026; the May and October Q&As, June financial-information notice and September certification Q&A were rechecked on 16 September. Private notifications and non-public catalogues cannot be established from a public website.
Three different kinds of evidence
Keep a source register and an entity-specific decision record. A classification standard helps identify candidate data; a regulator's catalogue or notice establishes the relevant designation; an internal inventory connects that rule to actual systems and processing activities. Finding one of these does not prove that the other two have been completed.
| Evidence | Question it answers | What it does not prove |
|---|---|---|
| Sector rule or identification guide | Which entity, activity and data characteristics should be examined? | That every listed business dataset is important data. |
| Catalogue, designation or direct notice | Which identified data is covered, by whom and from what date? | That export approval has been granted. |
| Internal inventory and filing record | Which systems, owners, recipients and changes map to the rule? | That a self-assessment replaces the authority's decision. |
Automotive, industry and telecom: compare the source coverage
The following matrix summarizes selected public rules; it does not reproduce a catalogue. In the MIIT framework, the local industry regulator depends on whether the activity is industrial, telecom or radio. A factory, a licensed telecom operator and a radio-frequency user should not automatically send the same filing to the same office.
| Activity and source | Identification coverage | Procedure and boundary |
|---|---|---|
| Automotive processing in China; 2021 trial provisions, Articles 2–3 | Article 3 expressly identifies categories including sensitive-area data, certain economic-flow and charging-network data, and exterior images containing faces or plates. | Articles 10–14 distinguish risk reporting, domestic storage, export assessment and annual reporting. This source map is not a full review of later automotive guidance. |
| Industrial R&D, production, operations and platforms; MIIT 2022 measures | Articles 7–11 require classification and entity inventories, with impact-based important/core data criteria. Detailed applicable guides and direct notices must also be checked. | Article 12 catalogue filing goes to the local industry regulator. Article 31 requires at least annual risk assessment for important/core data processors. |
| Telecom business and radio-frequency/station activities; the same MIIT framework | Article 3 defines separate telecom and radio data scopes. A reference to an identification guide is not proof that its complete contents are public. | Use the competent communications or radio regulator for the activity. Do not borrow a manufacturing inventory without reviewing scope. |
Finance has several overlapping source chains
Start with the regulated activity, not the word 'finance' in the company name. NFRA rules cover specified banking and insurance institutions. PBC rules concern data within the central bank's statutory business remit. The June 2026 financial-information guide concerns providers of market-relevant information services. More than one framework may apply to different activities in the same organization.
| Framework and scope | Important-data treatment | Practical reading point |
|---|---|---|
| NFRA banking/insurance measures, issued 27 December 2024; Article 2 institutions | Articles 16–19 require classification and dynamic inventories. Article 71 assigns catalogue development to NFRA; the management measures are not themselves a complete public catalogue. | Article 18 includes sensitive data within general data. Sensitivity alone does not establish important-data status; Article 36 refers exports to national requirements. |
| PBC business-domain measures; effective 30 June 2025, Article 2 | Articles 6–10 distinguish resource inventories, sensitivity labels and important-data identification/reporting. The PBC determines and notifies covered important data following the stated process. | Inventory updates are at least annual. Articles 22 and 24 address sharing assessments and cross-border duties separately. High sensitivity is not a substitute for designation. |
| Six-authority financial-information service guide; notice dated 8 June, published 13 June 2026 | The official Q&A describes 3 first-level, 9 second-level and 67 third-level categories, with classification, grading, important-data reporting and dynamic updates. | This is an identification/classification guide, not a blanket important-data designation. The notice states no separate effective date. State-secret and military data are outside its scope. |
- NFRA Banking and Insurance Data Security Measures: Articles 2, 16–19, 36, 71; issued 27 December 2024
- PBC business-domain measures: Articles 2, 6–10, 22, 24; effective 30 June 2025 (official PDF, pages 2–5 and 11–12)
- Financial Information Service Classification Guide: six-authority notice dated 8 June 2026, published 13 June
- Official financial-information guide Q&A: questions 2–5 on scope, 67 categories and classification
Numbers that answer different questions
Do not create a single threshold calculator for all these rules. The relevant population, data scale, trigger and recipient authority differ. The examples below preserve the boundary words in the source rather than rounding them into a generic '100,000-person rule'.
| Rule | Actual trigger | Avoid this inference |
|---|---|---|
| Automotive Article 3 | Personal information involving more than 100,000 individuals is one expressly listed important-data category. | Exactly 100,000 does not meet this particular wording, but other categories can still apply. This is not the ordinary-PI export threshold. |
| MIIT Article 12 change filing | A scale change of 30% or more, or changes to other filing content, triggers amendment within 3 months. | A smaller scale change is not a safe harbour if another filed detail changes. This is not an export volume-growth allowance. |
| National Regulation Article 28 | Processing PI of at least 10 million individuals extends Articles 30 and 32 duties to the processor. | It does not automatically reclassify every PI record as important data or apply every important-data provision. |
| CAC October Q&A, question 4 | After notice or public designation, continuing the relevant export requires an assessment application within 2 months through the provincial CAC. | This is a filing deadline, not an approval guarantee or an exemption from the assessment result. |
- Automotive Data Security Provisions (Trial): Articles 2–3, 10–14; effective 1 October 2021
- MIIT Data Security Measures (Trial): Articles 2–4, 7–12, 21, 31; effective 1 January 2023
- Network Data Security Regulation: Articles 28–33, 37–38; effective 1 January 2025
- CAC October 2025 Q&A: questions 4–5 on the two-month filing period and overseas access
- CAC September 2026 Q&A: questions 1–2 on certification limits; published 11 September
Where FTZ negative lists fit
Article 6 of the 2024 flow provisions creates a regional negative-list mechanism within the national framework. Check the current local instrument's entity, geography and sector conditions before relying on an outside-list treatment. A list used by one pilot region is not a national classification catalogue and cannot simply be applied to another location.
The national directory linked below provides the ten regional source chains and version history. This article checks the national legal connection; it does not renew the verification dates of all local annexes. Record the exact local version and any filing or reporting procedure that applies to the entity.
Identification is not export clearance
Under Article 37 of the national regulation, important data collected or generated during domestic operations requires CAC security assessment when it needs to be provided overseas. The provision also says data not notified or publicly designated as important need not be filed as important data. Read that statement with the obligation to identify and report under applicable rules; absence of a search result is not proof that no applicable notice exists.
The May 2025 Q&A separately addresses a narrower situation: no sector identification/classification rules have been published and the processor has not been told to identify and report. Its explanation about important-data-specific penalties does not waive personal-information, cybersecurity, contractual or other sector obligations. Keep both factual conditions in the decision record.
The 11 September 2026 certification Q&A expressly excludes important data from the described non-CIIO certification route. Voluntary certification at other volumes may demonstrate standards compliance, but cannot replace a required security assessment. A certificate therefore does not resolve a newly received important-data designation.
Keep three workstreams separate
First establish the data inventory and complete required identification/reporting. Next manage domestic processing: responsibilities, risk assessments, recipient contracts, incident controls and applicable periodic reports. Finally evaluate each export scenario, including overseas access to a domestic system. A completed inventory is evidence for the other workstreams, not a substitute for them.
MIIT Article 12 requires filing metadata, not the underlying dataset itself. Article 31 sets at least annual risk assessment for important/core data processors. Automotive Articles 13–14 use a separate annual reporting arrangement, including a 15 December deadline and additional export information where relevant. Assign different owners and dates rather than treating a single annual document as completion of every obligation.
Three hypothetical decisions
These are research examples, not determinations for a real company. Their purpose is to show which missing fact changes the next step.
Factory telemetry: a manufacturer proposes foreign-headquarters access to production dashboards. Separate ordinary machine logs from aggregated production, supply-chain or infrastructure data; review the MIIT scope, sector criteria and notices. Record where access occurs. Removing employee names does not by itself settle important-data classification, and keeping the server in China does not settle whether access is an export.
Automotive camera data: a small service processes exterior images containing recognizable faces or plates. Checking only whether it has more than 100,000 customers misses a separate Article 3 category. Examine the image content, the applicable processing role and the storage/export rules, even if the business is small.
Financial-information vendor: a provider sells market-analysis datasets to institutional subscribers. Start with the 2026 financial-information guide's service scope and classification process. Do not call every sensitive general-data item important data, or assume the provider is a bank. If the same group also conducts PBC-regulated business, document the additional source chain for that activity.
- MIIT Data Security Measures (Trial): Articles 2–4, 7–12, 21, 31; effective 1 January 2023
- CAC October 2025 Q&A: questions 4–5 on the two-month filing period and overseas access
- Automotive Data Security Provisions (Trial): Articles 2–3, 10–14; effective 1 October 2021
- Official financial-information guide Q&A: questions 2–5 on scope, 67 categories and classification
A review record that can be handed to the next reviewer
Use the following as an original working checklist, not an official filing template. Preserve a dated source copy in a controlled internal record, but do not put customer data or non-public regulator correspondence in a public source register. Review the decision when the dataset, recipient, activity, local list or authority notice changes.
| Record | Evidence to retain | Review question |
|---|---|---|
| Entity and activity | Legal entity, location, service role and competent department. | Does the source actually cover this activity? |
| Dataset and designation | Data categories, precision, scale, source clause and any authority notice/date. | Is this a candidate classification, a self-report or confirmed coverage? |
| Domestic duties | Inventory version, responsible owner, risk assessment and filing/report receipts. | Are changes and periodic duties being tracked separately? |
| Export and remaining obligations | Recipient, access location, purpose, approval scope and independent PI assessment. | Is a certificate or outside-list claim being mistaken for blanket clearance? |
- Network Data Security Regulation: Articles 28–33, 37–38; effective 1 January 2025
- CAC May 2025 Q&A: questions 1–2 on identification and exports
- MIIT Data Security Measures (Trial): Articles 2–4, 7–12, 21, 31; effective 1 January 2023
- PBC business-domain measures: Articles 2, 6–10, 22, 24; effective 30 June 2025 (official PDF, pages 2–5 and 11–12)
Official sources & revisions
- Network Data Security Regulation: Articles 28–33, 37–38; effective 1 January 2025
- CAC May 2025 Q&A: questions 1–2 on identification and exports
- Automotive Data Security Provisions (Trial): Articles 2–3, 10–14; effective 1 October 2021
- MIIT Data Security Measures (Trial): Articles 2–4, 7–12, 21, 31; effective 1 January 2023
- NFRA Banking and Insurance Data Security Measures: Articles 2, 16–19, 36, 71; issued 27 December 2024
- PBC business-domain measures: Articles 2, 6–10, 22, 24; effective 30 June 2025 (official PDF, pages 2–5 and 11–12)
- Financial Information Service Classification Guide: six-authority notice dated 8 June 2026, published 13 June
- Official financial-information guide Q&A: questions 2–5 on scope, 67 categories and classification
- 2024 Cross-border Data Flow Provisions: Articles 2, 6–7 and 10
- CAC October 2025 Q&A: questions 4–5 on the two-month filing period and overseas access
- CAC September 2026 Q&A: questions 1–2 on certification limits; published 11 September
: Replaced the short overview with sector and financial source matrices, numerical boundaries, hypothetical cases and a review record. Incorporated the September certification clarification without claiming an exhaustive national catalogue or copying sector annexes.
Examples and working tables are original research aids, not official forms or legal advice.
Suggest a correction