Data Protection and Privacy 2026

CHINA Trends and Developments Contributed by: Vincent Wang, Xinyao Zhao and Alfred Feng, Global Law Office

• The validity period of a certification is three years and can be extended by filing an application six months prior to the expiration of the validity period. Following the Measures on the Certification, CAC announced only three qualified professional certifica - tion institutions as of January 2026. Official Q&As from CAC on cross-border data transfers In 2025, CAC released two lists of Q&As to provide explanation about frequently asked questions con - cerning cross-border data transfers, in April and Octo - ber, respectively. The practice of cross-border data transfers has stabilised, and compliance burdens regarding cross-border data transfers are reducing. The April Q&As list offered a broader policy overview and high-level clarification of the Chinese cross-bor - der data transfer mechanism. It explains that China’s data export regime is to ensure secure and free flow for business needs, while regulating transfers involv - ing personal information and important data. It also highlights key supporting measures, such as the Free Trade Zone (FTZ) negative list system, which exempts certain data from standard compliance paths and specifies that important data is not prohibited from leaving but requires a security assessment process in accordance with the law. The April Q&As list also shares ways to raise the efficiency for multinational corporations in their cross-border data transfer, such as consolidated group filings and the forthcoming per - sonal information protection certification mechanism. On the basis of the April Q&As, the October Q&As list further clarifies business scenarios that can be exempted from the cross-border compliance mecha - nism. For example, cross-border shopping or exams are not limited to the examples listed in the law, but must meet two core conditions: they must be for concluding or performing a contract with an individ - ual being the counterparty; and the transfer must be based on the principles of being minimal and nec - essary. The October Q&As list explicitly states that domestic hotel bookings for domestic individuals do not qualify for the exemption. The October Q&As list also addresses specific operational questions, con -

firming that data processing system upgrades alone do not trigger reassessment. Increased focus on AI governance In 2025, Chinese authorities continued AI governance, focusing on the labelling of AI-generated content. This was not the first mention of labelling requirements for AI-generated content. In the Administrative Provisions on Deep Synthesis of Internet-based Information Ser - vices released in 2022, the legislation already stipu - lated that, for contents that may cause confusion or misidentification by the public, prominent labels shall be added to demonstrate that the contents are AI generated or edited. However, the standard for such labelling was not specified in the 2022 regulation. On 7 March 2025, the CAC, together with the Min - istry of Industry and Information Technology (MIIT), the MPS and the State Administration of Radio and Television (SART), released the Measures on Labelling AI-Generated or Composed Content (the “Measures on Labelling”), which came into effect on 1 September 2025. Highlights of the Measures on Labelling include the following. • The measures divided AI labels into explicit labels and implicit labels, and specified where to add explicit labels for different types of content, includ - ing text, voice, picture, video, virtual scene, etc. They also specified contents to be included under the implicit labels. • Different obligations are set for different parties, including the AI generation service providers that provide online information content dissemination services, the internet application distribution plat - form and users who upload AI-generated contents. Apart from the Measures on Labelling above, a com - pulsory national standard Cybersecurity technology – Labelling method for content generated by artificial intelligence (GB 45438-2025, the “Labelling Meth - od”) was also released in 2025, which provided more detailed instructions from a technology perspective and examples for different scenarios. The Labelling Method can be taken as a reference for companies

67 CHAMBERS.COM

Powered by