Short answer
China does not ban international data flows. A founder must identify what leaves China, why it leaves and which compliance route—or exemption—applies.
Red line 1 — classify before exporting
Identify personal information collected in China, sensitive personal information, and any data notified or publicly published as important data. Do not invent an important-data designation, and do not assume its absence without checking the relevant official notice.
Red line 2 — select the applicable route or exemption
The current rules include exemptions. A non-CIIO data handler exporting under 100,000 non-sensitive personal-information subjects since 1 January may be exempt from assessment, standard-contract and certification mechanisms in the specified situation. For 100,000 to fewer than 1 million non-sensitive subjects, or fewer than 10,000 sensitive-personal-information subjects, the rules point to a standard contract or certification. Important-data exports, CIIO cases, 1 million or more non-sensitive subjects, or 10,000 or more sensitive-personal-information subjects trigger security-assessment treatment, subject to the regulation’s stated exemptions.
Red line 3 — make the overseas recipient visible
Notice, separate consent and a personal information protection impact assessment can remain necessary duties. The official July 2026 Q&A also notes that where a PIPL Article 13 legal basis applies, consent may not be required, while notice obligations remain. Do not decide that exception from a checklist alone.
Red line 4 — treat security as an operating duty
Minimise the data, define the overseas recipient’s obligations, use appropriate technical and organisational safeguards, maintain an incident route and reassess when the facts change. One technical measure is not a universal pass condition.
Product triage before you ask for an answer
Does the product collect information from people in China, store it in China, or send it to an overseas model, cloud, CRM, analytics or support tool? If yes, document the answer, map the recipient and take the factual brief to an appropriate official source or qualified adviser before treating the route as settled.