Connected vehicles generate the most regulated data category in China. Between the CAC's automotive data rules, PIPL, and the 2024 cross-border data flow provisions, an export that looks routine β telemetry to your global engineering center, mapping updates, fleet analytics β can trigger a CAC security assessment. This checklist walks automotive companies through the 2026 decision process.
Step 1: Inventory and Classify Your Data
Before any threshold analysis, map every data flow out of China. For automotive businesses the categories that matter are:
| Data Type | Typical Examples | Default Sensitivity |
|---|---|---|
| Out-of-vehicle data (camera/radar) | Street imagery, surroundings recordings | Often "important data" β sensitive areas are the trigger |
| Location & trajectory | GPS tracks, geofenced areas, fleet movement | Potentially important data at scale; PI when linked to individuals |
| In-cabin personal information | Driver identity, biometrics, voice, cabin video | Personal information; biometric = sensitive PI |
| Vehicle operation data | Battery, charging network, autonomous-driving logs | May be important data in aggregate |
| Map/navigation data | HD map collection, surveying data | Heavily regulated β separate surveying & mapping rules apply |
Step 2: Determine Your Export Path
Run each data flow through the decision chain (mirrors our Data Export Self-Checker):
- CAC Security Assessment β required if: you are a CIIO transferring any data abroad; the flow contains important data; or personal information volumes exceed the statutory cumulative thresholds since January 1.
- SCC Filing or Certification β the middle path for personal information below assessment thresholds (and sensitive PI under the small-volume threshold): file standard contractual clauses with the provincial CAC or pursue personal information protection certification.
- Exemptions β limited categories exist (e.g. transfers necessary for cross-border transport/aviation safety, contract necessity with de minimis volumes, de-identified statistical data). Automotive operational flows rarely fit cleanly β document any exemption claim carefully.
Step 3: If Assessment Is Required β the Checklist
- PIPIA first. Complete a Personal Information Protection Impact Assessment and keep it on file β₯ 3 years β it is required for all cross-border paths and feeds the application.
- Self-assessment report. The CAC assessment application requires a detailed self-assessment: data types, volumes, fields, recipient country's legal environment, and contractual safeguards.
- File via provincial CAC. The operator submits to the provincial cyberspace administration, which forwards to the national CAC.
- Respond to supplementation. Budget at least one round of follow-up questions. Incomplete data-flow descriptions are the top rejection driver.
- Result validity. Assessment results have a limited validity period and must be renewed; material changes to the flow require re-application.
Step 4: The Localization Alternative
Most major automakers now default to local storage with selective export: keep Chinese vehicle data on Chinese servers, and only push genuinely necessary data (usually de-identified engineering data or consented personal information) through assessed channels. This "China cloud" model β pioneered by Tesla's Shanghai data center β is the pragmatic 2026 baseline. Costs: domestic cloud contracts, separate Chinese engineering environments, and a data governance team that can evidence separation.
Step 5: Ongoing Compliance
- Annual review of the data inventory and classification (regulators update catalogs).
- Consent management for in-cabin personal information (separate, specific consent for cross-border transfer).
- Contracts with overseas recipients covering PIPL Article 38 obligations.
- Monitor FTZ "free flow" pilot lists β Shanghai and other pilots maintain negative lists where certain data flows are eased; automotive "important data" remains restricted everywhere.
Quick Self-Check
Answer seven questions β CIIO status, important data, volumes, sensitivity β and get your required path with the Data Export Self-Checker. For the broader legal framework, read our Data Cross-Border Transfer Guide and the step-by-step SCC Filing Steps 2026.
Informational only β verify with official sources; not legal advice.