On 17 May 2024, the Administrative Committee of Lin-gang Special Area of China (Shanghai) Pilot Free Trade Zone, or the Lin-gang Administrative Committee, formally released three documents, or, collectively, the Shanghai Positive Lists, including

• the Lin-gang General Data List of Cross-border Data in Biomedicine scenario (Trial)《中国（上海〉自由贸易试验区临港新片区生物医药领域数据跨境场景化一般数据清单（试行）》;

• the General Data List of Cross-border Data in Intelligent Connected Vehicles scenario (Trial)《中国（上海〉自由贸易试验区临港新片区智能网联汽车领域数据跨境场景化一般数据清单（试行）》; and

• the General Data List of Cross-border Data in Public Fund (Trial)《中国（上海〉自由贸易试验区临港新片区公募基金领域数据跨境场景化一般数据清单（试行）》.

Rather than the Negative List issued by Tianjin Free Trade Zone, Shanghai released lists are Positive Lists. That is, according to the Shanghai Positive Lists, data under Biomedicine, Intelligent Connected Vehicles and Public Fund, may be freely outbound if enterprises fulfil the filing procedures and comply with the related management requirements.

13 August 2023

The State Council officially released the State Council's 24 Articles on Foreign Investment《国务院关于进一步优化外商投资环境 加大吸引外商投资力度的意见》which explicitly proposed to support Beijing, Tianjin, Shanghai, Guangdong-Hong Kong-Macao Greater Bay Area and other pilot area to explore the formation of the General Data List that data may freely flow.

8 February 2024

The Lin-gang Administrative Committee issued the Measures for Classification and Hierarchical Management of Cross-border Data Flow in Lin-gang Special Area (Trial)《临港新片区数据跨境流动分类分级管理办法(试行)》 and further specified the establishment of the General Data List.

22 March 2024

The Cyberspace Administration of China released the Provisions on Facilitating and Regulating Cross-border Data Flow《促进和规范数据跨境流动规定》, which specified that the Free Trade Zones may make their data lists, namely the Negative Data List. Enterprises may incorporate data that meets the scope of SA, SCC, and PCB as needed.

Combined with the aforementioned regulations and the Shanghai Positive Lists, which excludes core data and important data, is an opposed concept with the Negative List. In accordance with the Shanghai Positive Lists, enterprises do not need to fulfil the compliance on SA, SCC, and PCB, if they file with the Lin-gang Administrative Committee and compile with the certain regulatory requirements, the data can go abroad freely. Thus, the lists are also called the Positive Lists. Filing with the General Data List in the Free Trade Zone is usually mentioned as the fourth path for data outbound in China.

According to the Shanghai Positive Lists, if applied to the fourth path, enterprises need to fulfil the following three prerequisites:

1) Enterprises must be registered within the Lin-gang Special Area, and not be a CIIO;

2) Currently, the cross-border data must be within the range of 3 fields, including Biomedicine, Intelligent Connected Vehicles, and Public Fund. Totally, under the 3 fields, there are 11 sub-scenarios, 64 catalogues, and more than 600 data items. PI are without the list, if they are not in scenarios exempted from declaration according to the Provisions on Facilitating and Regulating Cross-border Data Flow. Also, data should not be clearly identified as important data；

3) Related data cross-border activities must be carried out in Lin-gang Special Area, excluding other plots of Shanghai Free Trade Zone. For example, resources such as outbound-related gateways, lines, servers, etc., should be located in the Lin-gang Special Area.

It is worth noting that the above application scope is stricter than that stipulated in the Measures for Classification and Hierarchical Management of Cross-border Data Flow in Lin-gang Special Area (Trial).

Although the first version of the Shanghai Positive Lists merely covers 3 fields, subsequently, considering related regulations and market demand, Shanghai will update the list scope in real time，expanding fields to Bank Guarantee for International Trade Finance, International Trade Settlement Letter of Credit Business, Reinsurance Business, Shipping Business, Consumer Retail and other areas.

1) Biomedicine

The first version of the Shanghai Positive Lists in the field of biomedicine covers 5 sub-scenarios, 30 data categories and 148 data items as below：

*HCP management data, which is widely watched by the industry, is not included this time.

2) Intelligent Connected Vehicles

The first version of the Shanghai Positive Lists in the field of intelligent connected vehicles involves 4 sub-scenarios, 23 data categories and 158 data items as below：

*The commonly concerned OTA data, and other data, which is included in the management of important vehicles data, including PI, are not fall within the scope of the Shanghai Positive Lists this time. Besides, the VIN number should not be able to identify an individual directly or indirectly in this scenario. The video and image data involved in this scenario should not contain PI such as face, vehicle license plate, etc.

3) Public Fund

The first version of the Shanghai Positive Lists of public funds in the field of market research, such as Industry Research Report, Macroeconomic Analysis Report, internal management, including Settlement Management Data, Vendor Management Data, Investor Management Data, Risk Management Data, Compliance Audit Data, etc., and contains 2 sub-scenarios of 11 data categories 344 Data items.

Pursuant to the Measures for Classification and Hierarchical Management of Cross-border Data Flow in Lin-gang Special Area (Trial) and the Shanghai Positive Lists, eligible enterprises in the area may transfer data freely, subject to the following requirements:

1) Submit the filing to the Lin-gang Administrative Committee through the online website <https://sjkj.lingang.gov.cn/>. The filing materials include, but are not limited to, the filing application form, the situation of outbound data, legal documents signed with offshore receivers, and self-regulatory compliance commitments. Enterprises may still need to correct and supplement some of the information as required while filing.

2) After successful filing, enterprises should deposit and back up the cross-border general data, currently not sure whether it is necessary to apply to the organization designated by the Lin-gang Administrative Committee. The back-up time should be not less than one year.

3) The filing is valid for 1 year. Within 2 months before expiry, enterprises need to apply for the continuation procedures. If filing information is changed, enterprises should apply for modification filing procedures.

4) The Lin-gang Administrative Committee will carry out daily supervision and spot check, on the data cross-border activities.

5) Enterprises shall carry out data outbound risk self-assessment in accordance with the law and take the initiative to identify and declare important data.

6) Enterprises still have to carry out MLPS, PCB, sign DPA with offshore recipients, achieve separate consent from data subject, etc. in accordance with the provisions of the Cyber Security Law《网络安全法》, the Data Security Law《数据安全法》, the PIPL《个人信息保护法》 and other regulations.

7) Compiling with other management requirements stipulated by the Operational Guidelines on General Data List of Cross-border Data in Lin-gang New Area (Trial) 《临港新片区数据跨境流动一般数据清单操作指南(试行)》, etc.