Introduction
In 2023, when the Beijing Data Rights Exchange opened on the fourth floor of a nondescript office building in Zhongguancun, the initial volume of traded data was modest—a few hundred million yuan in transactions involving logistics data, financial credit scores, and medical imaging datasets. By mid-2026, the exchange's annual transaction volume had grown to over 40 billion yuan, and it had been joined by similar exchanges in Shanghai, Shenzhen, Guangzhou, and Chongqing, each operating under slightly different regulatory frameworks.
This proliferation of data exchanges, operating under a patchwork of local pilot regulations, represents one of the most ambitious—if least internationally covered—experiments in data governance happening anywhere in the world. China is not waiting for a comprehensive national data law to figure out how data should be traded, valued, and used. It is running a network of live regulatory experiments, each with its own rules, and using the results to inform eventual national policy.
For foreign businesses operating in China, or companies considering entering the Chinese market, this is not an academic question. The regulatory environment for data—how it can be collected, processed, transferred, and monetized—is now a direct factor in business strategy. And the pilot zone system means that the rules vary depending on where you are operating, which creates both opportunities and significant compliance complexity.
This article examines the current state of China's data economy regulatory experiments in 2026: what the pilot zones are doing, what the emerging patterns are, and what the international implications look like from the ground.
Related: China's National Unified Data Market: July 2026 Developments
The Regulatory Architecture: How China's Data Governance Works
China's data governance framework is built on three foundational laws enacted between 2021 and 2022:
The Data Security Law (数据安全法), effective September 2021, established a classification system for data based on its importance to national security and social governance. Data is categorized as ordinary (普通数据), important data (重要数据), or core data (核心数据), with progressively stricter requirements for each tier.
The Personal Information Protection Law (个人信息保护法), effective November 2021, is China's equivalent of the EU's GDPR—a comprehensive framework for the collection, use, storage, and transfer of personal information, with requirements for consent, purpose limitation, data minimization, and individual rights.
The Cyber Security Law (网络安全法), in effect since 2017, establishes baseline requirements for network security and data localization for critical information infrastructure operators.
These three laws form the national framework. But the enforcement and elaboration of this framework happens at the local level through a series of pilot regulations, experimental zones, and administrative measures that have been accumulating since 2022.
The Major Data Economy Pilot Zones
Beijing: The Zhongguancun Data Exchange
Beijing's pilot framework, centered on the Zhongguancun Data Rights Exchange (中关村数据交易所), has focused on establishing data asset accounting standards—what constitutes a data asset, how it is valued, and how it appears on corporate balance sheets.
The Beijing approach has been the most aggressive in addressing the accounting question. In 2025, Beijing became the first Chinese city to publish formal guidelines for data asset valuation, establishing three approved methodologies: cost-based valuation, market-based valuation, and income-based valuation. Companies listing data assets on the Beijing exchange must use one of these three methodologies, certified by an approved third-party valuer.
For foreign companies operating in Beijing, this has created an unexpected opportunity: data assets can now be formally recognized on Chinese subsidiary balance sheets, which affects how data infrastructure investments are treated for regulatory and tax purposes. The valuation framework has also made it possible to use data assets as collateral for loans—a provision that has been used by several tech companies to access financing against their training datasets.
Shanghai: Cross-Border Data Flows
Shanghai's pilot zone, formally designated as the Shanghai Pilot Free Trade Zone Lin-gang Special Area, has become the primary testing ground for cross-border data flow regulations.
The Shanghai framework allows participating companies to transfer data outside China under a simplified approval process, provided the data meets certain classification requirements. The key categories for cross-border transfer under the Shanghai pilot are:
- Ordinary personal information of non-sensitive nature, processed according to standard consent and purpose-limitation rules
- Business operation data that does not involve sensitive personal information or important data categories
- Data that has been anonymized according to specified technical standards, with third-party certification
The pilot has been particularly significant for financial services companies. Shanghai-based foreign banks and asset managers have used the cross-border data provisions to transfer transaction data and risk assessment models to their global operations centers, a practice that was previously either prohibited or required case-by-case approval from multiple regulatory bodies.
The practical effect: a financial services company running operations from Shanghai can now maintain consistent global risk models and reporting standards without the massive compliance overhead that the standard cross-border data transfer process would require.
Shenzhen: AI Training Data and Technology Companies
Shenzhen's pilot zone has focused on the intersection of data governance and AI development. The Shenzhen framework addresses two questions that the national laws left deliberately open: what data can be used to train AI models, and how should model training datasets be documented and disclosed?
The Shenzhen approach establishes a Data Training Compliance Framework for AI development. Companies developing AI models using data sourced from Shenzhen-based operations must maintain detailed records of:
- The categories and volume of data used in training
- The consent mechanisms used to authorize data use
- The data processing steps applied before training (cleaning, anonymization, augmentation)
- The third-party audits the company has undergone
This is not yet a mandatory disclosure requirement to regulators, but it is a formal record-keeping standard that can be requested during regulatory review. For foreign AI companies operating in Shenzhen, the framework has created a compliance structure that was previously undefined—a set of rules you can follow, rather than a set of rules you're hoping not to violate.
Chongqing and Xi'an: Industrial Data Exchange Pilots
Chongqing and Xi'an have focused on industrial and manufacturing data—the data generated by factory floor operations, supply chain management systems, and equipment monitoring. These pilot zones have established data exchanges specifically for industrial data, with regulatory frameworks addressing:
- Equipment operating data (machine performance, maintenance cycles, energy consumption)
- Supply chain transaction data (orders, logistics, inventory)
- Quality control data (inspection records, defect tracking, yield rates)
The industrial data exchanges have been notably active. Chongqing's exchange has facilitated data trading between automotive manufacturers and their component suppliers, enabling a form of supply chain optimization that previously required extensive bilateral data-sharing agreements and was practically limited by the legal uncertainty around what could be shared and how.
What Foreign Businesses Are Actually Doing
The pilot zone system has created a tiered compliance landscape where the rules depend on where you operate and what kind of data you handle.
The Practical Effect on Compliance Strategy
Companies that have mapped their operations to the relevant pilot zones are finding that the pilot regulations offer meaningful operational advantages over the baseline national framework. The cross-border data transfer provisions in Shanghai, in particular, have reduced compliance overhead significantly for companies whose global operations require data flows that the standard national regulations would treat as high-risk.
The data asset valuation framework in Beijing has made it possible to have formal conversations with Chinese financial institutions about data as a business asset, which was previously difficult because there was no recognized accounting treatment.
The AI training data framework in Shenzhen has given AI companies a set of rules they can follow and document, which provides some protection against future regulatory scrutiny—even though the rules are still experimental.
The Compliance Complexity Problem
The pilot zone system also creates compliance complexity. A company operating in multiple cities may find itself subject to different rules for the same type of data processing depending on where the processing takes place. The data asset valuation methodologies approved in Beijing are not formally recognized in Shanghai. The AI training compliance framework in Shenzhen does not have an equivalent in Beijing.
For multinational companies with operations across China, this means that data governance cannot be managed as a single, unified compliance program. The regulatory mapping has to be done city by city, data type by data type, which substantially increases the compliance overhead.
The Emerging National Data Market
The national data market—officially the 全国一体化大数据中心 (National Integrated Big Data Center)—has been under construction since 2022 and reached a significant milestone in 2025 with the launch of the cross-regional data circulation system.
The system connects the major regional data exchanges (Beijing, Shanghai, Shenzhen, Guizhou, Chongqing) into a unified network, enabling data assets registered in one exchange to be listed and traded on others. The technical infrastructure for this circulation system—standardized data formats, identity verification, settlement mechanisms—is now operational, though the transaction volumes remain heavily concentrated in the Beijing and Shanghai exchanges.
For international businesses, the national data market creates a pathway for participating in China's data economy at scale. The key question is access: foreign companies can list data assets on the exchanges and can purchase data from other listing entities, but there are restrictions on what categories of data foreign entities can list, and the cross-border data transfer provisions still apply to any data that involves personal information or important data.
Data Security Enforcement in 2026
China's data security enforcement has intensified significantly in 2025 and 2026. The Cyberspace Administration of China (CAC) has:
- Conducted cross-province compliance audits of major tech companies, focusing on cross-border data transfer compliance
- Issued compliance guidance for AI training data practices, which companies are expected to follow even in the absence of formal regulation
- Established a data breach notification requirement, requiring companies to notify the CAC within 24 hours of discovering a data breach affecting personal information or important data
The enforcement pattern shows a clear priority: companies that are actively engaging with the pilot zone frameworks and demonstrating compliance effort are receiving more cooperative regulatory treatment than companies operating outside the pilot structures. The message from regulators is implicit but consistent: if you want regulatory latitude, get inside the system.
The International Dimension: China's Data Governance and Global Tech Governance
China's data economy experiments are happening in a global context where data governance has become one of the major fault lines in international tech policy.
The EU's approach—comprehensive data protection through GDPR, plus the emerging Data Governance Act and Data Act—represents one model. The US approach—sectoral regulation, limited federal privacy law, and aggressive enforcement against anticompetitive data practices—represents another. China's approach, with its data classification system, national security framing, and pilot zone experimentation, represents a third model that does not fit neatly into either Western category.
What is increasingly clear in 2026 is that these three models are not developing in isolation. The data flows between China and other economies—the training of AI models on multilingual datasets, the cross-border provision of financial services, the operation of global supply chains—are creating pressure for some form of interoperability between these frameworks.
China's data economy pilot zones are, in effect, a laboratory for figuring out what Chinese-style data governance looks like in practice. The results will inform China's negotiating positions in international data governance forums and shape the eventual architecture of any global data governance framework.
For foreign businesses, the practical implication is that the pilot zone rules are not temporary. They are the first generation of what will eventually become a more settled regulatory framework. Getting familiar with how they work now—understanding the data asset valuation methodologies, the cross-border transfer provisions, the AI training compliance requirements—is not compliance overhead. It is business development in the fastest-growing data economy in the world.
FAQ: Foreign Businesses' Most Common Questions
Can foreign companies list data assets on China's data exchanges?
Yes, under certain conditions. Foreign companies with Chinese-registered entities can list data assets on the regional exchanges. The listing must comply with the exchange's specific rules for data classification and valuation. Ordinary business data and non-personal operational data are generally eligible for listing. Personal information and important data require additional compliance steps and may be restricted from listing.
How does the Shanghai cross-border data transfer work in practice?
Companies operating in the Shanghai Pilot Free Trade Zone can apply for a simplified cross-border data transfer certification. The process involves submitting a data impact assessment, documenting the data categories and transfer purposes, and obtaining certification from the Shanghai Data Exchange. Certified companies can transfer approved data categories to overseas entities without requiring case-by-case regulatory approval. The process typically takes 4–8 weeks for initial certification.
What are the compliance requirements for AI training in China?
There is no comprehensive national AI training data law, but the Shenzhen pilot framework establishes the most detailed guidance currently available. The general requirements, based on CAC guidance issued in 2025, include: obtaining appropriate consent for training data use, maintaining records of data processing steps, conducting anonymization assessment for personal data, and documenting the compliance process in a form that can be provided to regulators upon request. Companies using Chinese user data to train AI models should treat these requirements as the de facto standard.
What data cannot be transferred across borders?
Core data (核心数据)—data whose loss or compromise would threaten national security—cannot be transferred across borders. Important data (重要数据) requires formal approval from the relevant sector regulator before cross-border transfer. Personal information of Chinese citizens requires either a security assessment (for high-volume transfers), standard contractual clauses approved by CAC, or certification under an approved cross-border data transfer mechanism (such as the Shanghai pilot provisions). Sensitive personal information (health data, financial data, biometric data, location data) requires heightened consent and additional protection measures before any cross-border transfer.
How are China's data regulations affecting foreign tech investment?
The regulatory uncertainty around data governance was a significant factor in foreign tech investment decisions in 2022–2024. The pilot zone system has provided more clarity in specific areas—particularly cross-border data flows for financial services and data asset treatment for accounting purposes—which has reduced some of the uncertainty. The overall regulatory environment remains complex, but companies that have invested in understanding the pilot zone framework are finding that workable compliance pathways exist. The areas of greatest ongoing uncertainty are AI training data and data that could be classified as important data.
What is the current status of the national unified data market?
As of mid-2026, the national data market infrastructure connects the major regional exchanges and enables cross-regional data circulation. Transaction volumes are growing rapidly but remain concentrated in industrial data, financial data, and logistics data. Personal information data trading remains restricted and heavily regulated. The national market is expected to reach full operational status—meaning standardized rules, universal access, and consistent enforcement across all participating exchanges—sometime in 2027–2028, based on the current development trajectory.
Conclusion
China's data economy is at an inflection point. The pilot zone experiments have generated enough practical experience that regulators are beginning to synthesize the results into more consistent national guidance. The data exchange infrastructure is operational. The cross-border transfer provisions are working well enough that foreign companies in the Shanghai pilot are using them routinely. The AI training compliance framework is embryonic but functional.
The picture that emerges from 2026 is of a system that is messy—multi-layered, inconsistent across cities, subject to frequent regulatory updates—but increasingly navigable. Companies that have invested in understanding the specific rules of the specific zones where they operate are finding that workable compliance structures exist, and that engaging with the pilot frameworks directly is more effective than trying to apply the national laws mechanically to situations the national laws don't clearly address.
For international businesses, the question is no longer whether to engage with China's data economy. The question is how to engage intelligently—understanding which rules apply where, which pilot provisions create real operational advantages, and how to position for the eventual national framework that these experiments are building toward.
The data exchanges are trading billions of yuan worth of assets. The cross-border provisions are enabling operations that were previously impossible. The AI compliance frameworks are providing the documentation structure that regulators are beginning to ask for. Whatever the geopolitical framing of China data governance internationally, the practical reality inside China in 2026 is of an economy that is building, piece by experimental piece, a functional data market.
Stay informed: China's Technology and Economy: 2026 Highlights