Classify before choosing an export route
China’s Cyberspace Administration explains that its cross-border framework distinguishes personal information and important data and includes security-assessment, standard-contract, and certification routes. Its 2024 provisions also describe exemptions and adjusted thresholds. These distinctions require a fact-specific review: do not infer that a dataset is freely exportable merely because names have been removed or the initial sample is small. Ask qualified mainland counsel to assess the source, sector, sensitivity, and current requirements.
Map cumulative activity and access
Prepare an inventory of people represented, sensitive fields, data origins, recipients, and prior exports relevant to the analysis. The CAC explanation discusses cumulative counting and differing treatment for certain categories and operators. Avoid quoting a threshold as a universal safe harbour. Remote access, onward sharing, model-training infrastructure, and annotation workflows should all be described to counsel before the team decides how to deliver an evaluation sample.
Do not confuse an exemption with ownership
Even where a particular export procedure does not apply, independently verify source permissions, confidentiality, intellectual-property rights, and the proposed processing purpose. For technical or industrial datasets, ask about important-data and sector classifications rather than assuming that non-personal means unrestricted. For text and speech, document collection authority, region and language coverage, labelling quality, and exclusions. Start buyer discussions with aggregate specifications or synthetic examples while the review remains open.
- Identify the actual mainland source and operating entity.
- Review classification, cumulative volumes, and the intended recipient chain.
- Document the applicable route or exemption and its boundaries.
- Keep current local requirements and required filings in the release checklist.
Review before release
Sources reviewed on 19 October 2026. This is a preparation checklist, not legal clearance, tax advice, or confirmation that an AI lab accepts suppliers from this jurisdiction. Ask qualified local counsel to review the actual dataset, collection history, proposed training purpose, recipient, and current rules before releasing personal data.