China fined Trip.com RMB 10 million for illegal outbound data transfers in June. The U.S. DOJ's bulk-data rule passed its first reporting deadline in March. If your company moves data between China and the U.S., you are now regulated on both ends — and the two regimes point in opposite directions.
China's cross-border data transfer framework is no longer a paper exercise. The three pathways are fully operational: (1) CAC security assessment, (2) Standard Contract filing, or (3) personal information protection certification.
The thresholds, set by the March 2024 Provisions on Promoting and Regulating Cross-Border Data Flows and still current, work like this:
Two 2026 developments matter. First, enforcement is real: on June 13, 2026, the Shanghai cyberspace authority fined Trip.com (Ctrip) RMB 10 million and ordered rectification for failing security assessment duties and illegally transferring personal information overseas. Second, the free-trade-zone negative lists keep expanding — nine FTZs plus Hainan now have them, and Shanghai and Beijing extended their lists citywide in April and May 2026. Data not on the list can leave the FTZ without a transfer mechanism, which makes the negative list, not the national rulebook, the practical starting point for many companies.
The pain points we see most: volume creep — the 100,000-person threshold accumulates over the calendar year, so a company compliant in Q1 can cross into Standard Contract territory by Q3 without noticing; and "important data" ambiguity — with no single national catalog, sector catalogs and FTZ lists are the working definitions, and misclassification is now treated as live enforcement risk.
On the American side, the Justice Department's bulk sensitive personal data rule (28 CFR Part 202, implementing Executive Order 14117) took effect April 11, 2025. It restricts or prohibits "covered data transactions" involving China (including Hong Kong and Macau), Cuba, Iran, North Korea, Russia, and Venezuela — and their "covered persons."
What catches Chinese companies off guard:
Layer on the state privacy patchwork — new comprehensive laws took effect in January 2026 in Indiana, Kentucky, and Rhode Island, Arkansas followed in July, Maryland's strict regime entered full enforcement in April, and California's amended rules (risk assessments, cybersecurity audits) took effect January 1, with the largest CCPA settlement ever ($12.75 million against GM, May 2026) landing the same season. Nearly two dozen states now have comprehensive laws and no federal statute preempts them.
Here's the structural problem: China requires a transfer mechanism to push HR, customer, and analytics data out of China, while the U.S. DOJ rule restricts the same data coming in to China-side personnel when it qualifies as bulk U.S. sensitive personal information. A U.S. customer database administered from the Shanghai office is regulated on both ends, in opposite directions.