Editor’s Note — DCC.
This is a DCC-compiled roundup, not a translation of a single article. It maps the data-export negative lists in force as of July 2026, drawing on the Cyberspace Administration of China’s official negative-list index — which records each region’s filing with the national CAC and National Data Administration — and on each region’s own issuing notice. It is the companion to DCC’s new Data-export negative-list registry, where every list below is catalogued with its scope and official source and the originals can be downloaded.
For the mechanism — how a negative list works and the structural patterns across zones — see DCC’s explainer, FTZ Data Export Negative Lists — How 17 Sectors Now Identify Important Data. This brief is the current-state map that explainer’s August-2025 snapshot has since outgrown.
What changed since the last count
When DCC last mapped this in August 2025, seven free-trade zones had published negative lists. Eleven months later the count is ten regions, and the more important shift is qualitative: in 2026 the mechanism left the free-trade-zone footprint. Beijing extended its list to the whole municipality (the FTZ plus the National Service-Sector Opening Demonstration Zone — the “Two Zones”), and Shanghai extended eligibility city-wide, so an enterprise no longer needs to be registered inside a bonded zone to use the negative-list path. The first Shanghai filing — Inditex’s China arm, cleared in June 2026 — ran through Jing’an District, not Pudong. What began in Tianjin in 2024 as an FTZ experiment is now, in its two largest adopters, a province-level regime.
The map as of July 2026
All of these rest on Article 6 of the 2024 Provisions on Promoting and Regulating Cross-border Data Flows: data on a list needs the standard CAC pathway — a security assessment, a Personal Information Standard Contract filing, or protection certification; data off it flows freely.
| Region | Version | Sectors listed | Model |
|---|---|---|---|
| Guangdong (FTZ) | 2025 | Smart-equipment manufacturing; personal credit reporting | Post-export |
| Beijing (province-wide) | 2025 | Automotive, pharma, civil aviation, retail, AI, medical devices, autonomous driving, trade logistics, banking | Pre-export |
| Shanghai (city-wide) | 2025 | Reinsurance, international shipping, commerce, meteorology, retail | Post-export |
| Fujian (FTZ) | 2025 | Medical/pharma, connected vehicles, retail, aircraft maintenance | Pre-export |
| Chongqing (FTZ) | 2025 | Intelligent connected vehicles | Pre-export |
| Guangxi (FTZ) | 2025 | Geo-info & meteorology, enterprise credit, livestream e-commerce, overseas A/V | Pre-export |
| Jiangsu (FTZ) | 2025 | Biopharmaceutical | Pre-export |
| Zhejiang (FTZ) | 2024 | Cross-border e-commerce (B2B), clearing & settlement | Pre-export |
| Hainan (Free Trade Port) | 2024 | Deep-sea, aerospace, seed industry, tourism & duty-free | Pre-export |
| Tianjin (FTZ) | 2024 | Strategic goods, natural resources, industrial, financial | Pre-export |
Scope figures, issuing bodies, and the official source for each are on the registry. A few are worth pulling out. Beijing’s 2025 list is the broadest by far — 9 industries, 67 scenarios, 612 data fields — and reads as the reference catalogue other zones borrow from. Shanghai’s is the most operationally proven, with the first completed filing on the books. At the other end, several 2025 lists are deliberately single- sector: Chongqing lists only intelligent connected vehicles (4 business activities, 9 scenarios, 110 data items across the full ICV chain); Jiangsu lists only biopharmaceutical data, and reports cutting end-to-end export timelines for it by 30–50%.
Two models have crystallized
The zones have split into two administrative models, and the difference is practical, not cosmetic:
- Pre-export filing — the enterprise applies to, and files with, the FTZ administrator before transferring; the zone confirms the data’s status and the standard CAC pathway (where required) follows. This is the original Tianjin/Beijing/Zhejiang pattern, and it is what Fujian adopted — with a three-year validity on an approved filing.
- Post-export reporting — the enterprise self-assesses against the list, transfers, and then reports to the local cross-border data service centre. Shanghai (report within 15 working days) and Guangdong (先用后报, “use first, report after”) are the two examples. It front-loads less friction, at the cost of putting the classification judgment squarely on the enterprise.
For a compliance team, the model determines whether the negative list is a gate you pass through before shipping data or a safe harbor you document and report into. Same instrument, materially different operational posture.
Sector logic — each zone plays to its economy
The lists are not uniform national catalogues; each zone lists the sectors that match its strategic role. Reinsurance and international shipping in Shanghai; intelligent connected vehicles in Chongqing (China’s largest vehicle-producing municipality); biopharma in Jiangsu; deep-sea, aerospace and seed data in Hainan; geographic-information and ASEAN-facing livestream commerce in Guangxi; smart-equipment manufacturing and personal-credit reporting in Guangdong. The same industry can appear in several zones with different scope — retail “member management” data is listed in Shanghai, Fujian and Beijing, but Hainan’s retail entry is scoped to duty-free and clearance shopping. The practical consequence: the zone whose list you read matters as much as the sector.
What overseas teams should do with the map
- Check whether your sector is now listed somewhere — then check where you sit. Because a negative list doubles as a public important-data catalogue for its sector, the lists are the best sector-specific identification reference in existence, even for enterprises outside every zone. If your data falls off a relevant list, that is the argument for free flow; if it falls on, the standard pathway applies.
- Re-test entities in Beijing and Shanghai first. These two are no longer FTZ-gated. A Beijing- or Shanghai-registered entity in a listed sector may have moved a tier — from security assessment down to a standard-contract filing, or from a filing down to exemption — without relocating anything.
- Read the model, not just the list. A pre-export zone means file before you ship; a post-export zone (Shanghai, Guangdong) means you may ship and report, but you own the classification call.
- Treat the map as provisional. Every list provides for dynamic revision and for new sectors to be added; Guangdong’s even lets it borrow other zones’ lists. Monitor the issuing bodies and re-review at least annually — or watch the registry, which DCC updates as lists move.
The direction of travel is clear enough: a two-track cross-border regime — standard CAC pathways nationwide, plus a widening negative-list track that, in Beijing and Shanghai, is no longer confined to the zones at all. Multinationals that map their China data footprint against it will operate at materially lower friction than those that ignore it.
— Compiled by DCC from the Cyberspace Administration of China’s data-export negative-list index and each region’s official issuing notice (linked from the registry), July 2026.
Not legal advice. Scope figures are transcribed from official notices and their policy Q&As and may be partial; the published lists and their supporting measures are authoritative. Verify the current version against the official source before relying on any entry.