Direct answer: For a manufacturer going global, map where data is collected, where it is transferred and who can access it. If website forms, CRM, AI customer service or email send personal information or important data from China to another country, it may be a cross-border transfer—build the data map before choosing a legal path.
This guide is for manufacturers with an overseas website, overseas CRM, AI customer service, cross-border sales or overseas employees. It covers website forms, customer data, chat logs, drawings/BOM and employee data, and how to prepare contracts/assessments. Information is current to 2026-10-29. This is not legal advice and does not promise a filing, assessment or certification result; applicable law, the local cyberspace authority and professional advice govern.
Draw the data flow before discussing contracts; classify personal information/important data before choosing assessment, standard contract or certification; EU customers also require a GDPR and transfer-mechanism review.
What counts as a cross-border transfer for a manufacturer going global?
Look at where data is collected, where it is transferred and who can access it; a website form, CRM, AI customer service or email that sends personal information or important data from China abroad may be a cross-border transfer.
“Cross-border” depends on the actual transfer and access path, not the server brand or contract title. Customer names, emails, phone numbers, chat logs and quote/order data collected in China and sent to an overseas CRM, cloud contact centre, email platform or model API may be a personal-information transfer. Drawings, BOM, process parameters and customer lists may also involve important data or trade secrets. Conversely, data collected abroad and sent to China for processing must also be checked if it is transferred out again.
| Data type | Examples | Check first | Evidence |
|---|---|---|---|
| Website form/inquiry | Name, email, phone, company, need | Personal information? Where stored? Who receives it? | Field list, privacy policy, transfer record |
| CRM/email | Contacts, communication, quotes | Vendor/subprocessor/server location | System list, DPA |
| AI customer service/chat | Chat, orders, contact details | Do prompts/logs contain personal data? Where is the model? | Data-flow diagram, log settings |
| Drawings/BOM/process | Product structure, parameters, customer drawings | Important data/trade secret? | Classification list, authorisation |
| Overseas employees/HR | Employee data, assignment, payroll | Does the HR exemption apply? Who receives it? | Notice/contract/record |
| Cookie/analytics | IP, device, behaviour, ad identifiers | Personal data? Cross-border? | Cookie list, consent record |
| Public material | Published product material, samples | Personal data/confidential content? | Source, copyright/confidentiality check |
Data classification is a project judgement, not a legal conclusion; personal information, important data and trade secrets must be confirmed under the law, sector rules and company facts.
Should the data map or the contract come first?
Build the data map and classification first, then choose the contract/assessment; without knowing where data is, who receives it and how much is transferred, a template contract cannot determine the path.
A data map should cover source, fields, storage location, recipient, transfer method, access, retention and deletion. A website form may feed email, CRM and a chat tool at the same time; AI customer service may send conversations to a model API; overseas sales may use personal cloud drives or WeChat to send files. Draw these paths before deciding whether a transfer occurs, which path applies, and what notices/contracts are needed.
| Map field | What to write | Evidence | Common issue |
|---|---|---|---|
| Source | Website, exhibition, email, support, employee | Form/source record | Only “customer provided” |
| Fields | Name, contact, need, order, sensitive data | Field list | Collecting too much |
| Storage | China/overseas, cloud/on-premise, operator | System list | Server location unknown |
| Recipient | CRM/support/model/email/distributor | Contract, subprocessor list | Undisclosed outsourcing |
| Transfer | API, email, file, manual export | Data-flow diagram | Personal WeChat/cloud drive |
| Retention/deletion | Term, deletion, backup, exit | Policy/record | Kept forever |
The map should cover website, CRM, support, email, advertising, HR and suppliers; this article gives no legal classification conclusion—confirm with legal/cyberspace advisers.
How should the China path be chosen: assessment, standard contract or certification?
Choose by data type and annual cumulative volume: important data/CIIO/1M+ non-sensitive or 10k+ sensitive go to assessment; 100k+ go to standard contract/certification; below that, notice and consent still apply.
China's 2024 rules set tiers: critical information infrastructure operators (CIIO), important data, 1,000,000+ non-sensitive personal-information records or 10,000+ sensitive records transferred abroad cumulatively since 1 January generally require a data-export security assessment; 100,000–<1,000,000 non-sensitive or <10,000 sensitive records may use the standard contract or certification; <100,000 non-sensitive records are exempt from the three mechanisms but still require notice, consent, impact assessment and other obligations. Free-trade-zone negative lists may provide further exemptions. The current text and local cyberspace authority govern.
| Situation (cumulative from 1 Jan) | Usual path | Key action | Evidence |
|---|---|---|---|
| Important data / CIIO / ≥1M non-sensitive / ≥10k sensitive | Security assessment | Provincial filing, assessment, remediation | Assessment result/remediation |
| 100k–<1M non-sensitive / <10k sensitive | Standard contract or certification | Contract/certification and obligations | Contract/certification/record |
| <100k non-sensitive | Exempt from three mechanisms | Notice, consent, PIA, contracts/security | Notice/consent/PIA record |
| Contract necessity, HR, emergency | Exempt from three mechanisms | Check conditions, keep evidence | Facts/contract/record |
| Outside FTZ negative list | Exempt per list | Check list version/area | List/applicability record |
Thresholds/paths reference China's 2024 cross-border data rules; standard contracts also involve the Standard Contract Measures, and assessment the Security Assessment Measures. The current text and local authority govern; not legal advice.
What should be checked for website forms, CRM and AI customer service?
For website forms check fields/storage/forwarding; for CRM check vendors and subprocessors; for AI customer service check prompts/logs/model location; all three can send personal data abroad.
Website forms are the easiest place for “collect and forward everywhere”: a notification email, a CRM plug-in or a chat widget may send data to different countries. CRM needs the vendor, subprocessors, data centres and backups checked; AI customer service needs prompts, chat logs, model API and human review locations checked. Do not assume data stays in China because the tool has a Chinese interface.
| Scenario | Typical flow | Check first | Common mistake |
|---|---|---|---|
| Website form | Visitor→form→email/CRM/support | Fields, recipients, storage, forwarding | Only editing the privacy policy |
| CRM | Sales→CRM→vendor/backup | Data centre, subprocessors, export | Assuming SaaS stays local |
| AI customer service | Visitor→chat→model API→logs | Prompts/logs, model location, human review | Only testing answer quality |
| Email marketing | Contacts→email platform→analytics | Platform location, unsubscribe, tracking | Mass email without consent |
| Overseas HR | Employee→HR system→HQ | HR exemption, recipient, retention | Default group sharing |
| Drawings/BOM | Engineer→drive/email/customer | Important data/trade secret, authorisation | Personal cloud drive |
| Cookie/analytics | Visitor→analytics/ad platform | Consent, cross-border, anonymisation | Tracking on by default |
The scenario list is for questions and checks, not a substitute for classification, PIA/TIA or legal advice; confirm the actual data flow.
What else is needed for EU/overseas customers?
EU customers also require a GDPR review of lawful basis, notice, transfer mechanism (adequacy/SCC/BCR), TIA and DPA; China and EU requirements may both apply to the same data flow.
If EU/EEA data subjects are involved, check the GDPR lawful basis, notice, data-subject rights, retention and transfer tool in addition to the China path. A transfer outside the EU usually needs an adequacy decision or appropriate safeguards such as SCCs/BCRs, plus a transfer impact assessment; a DPA is needed with processors. China compliance and EU compliance are not alternatives—one data flow may need both.
| Item | What to confirm | Evidence | Common issue |
|---|---|---|---|
| Lawful basis/notice | Contract, consent, legitimate interest, etc. | Privacy policy, notice record | Only an English paragraph |
| Transfer mechanism | Adequacy/SCC/BCR, etc. | Agreement/decision | Assuming a DPA is enough |
| TIA | Destination law, access, remedies | Assessment record | No risk analysis |
| DPA | Roles, subprocessors, security, deletion | Contract | Only an NDA |
| Data-subject rights | Access, correction, deletion, objection | Process/record | No channel |
| Retention/deletion | Term, backup, exit | Policy/record | Kept forever |
EU rules can reference the European Commission data-protection page and SCC page; applicability depends on legal advice and the contract. Not legal advice.
How should vendor contracts be accepted?
The contract should state data role, location, subprocessors, security, cross-border mechanism, deletion, audit, breach and termination; an NDA alone is not enough, and the clauses must be verifiable.
A website/CRM/AI customer service/cloud contract should answer: who is processor/joint controller, where data is stored, which subprocessors are used, what cross-border mechanism applies, how changes are notified, how data is deleted/returned, how quickly a breach is notified, whether audit is allowed, and what happens on termination. The clauses must match the privacy policy, data map and actual configuration; “we will keep it confidential” does not cover cross-border transfer or deletion.
| Clause | What to write | Evidence | Common issue |
|---|---|---|---|
| Role/scope | Processor/controller, purpose, data types | Contract/annex | Role unclear |
| Location/subprocessors | Data centre, remote access, subcontracting | List/change notice | Undisclosed subcontracting |
| Cross-border mechanism | Assessment/standard contract/certification/SCC | Agreement/record | Only “may transfer” |
| Security | Access control, encryption, logs, vulnerabilities | Security note/audit | Generic promise |
| Deletion/return | Term, backup, post-termination | Process/record | Kept forever |
| Breach/audit | Notice deadline, cooperation, audit right | Clause/drill | Only after an incident |
Contract terms depend on roles, data flow and applicable law; no template or legal advice is provided.
How should this be implemented in 90 days?
Weeks 1–2 build the data map, weeks 3–4 choose the path, weeks 5–8 fix contracts/security, weeks 9–12 test and archive; set a pause gate at each stage and keep records.
Cover the website, CRM, support, email, HR and suppliers first, then classify data and cumulative volume; allow time for legal and cyberspace-authority communication if assessment/contract/certification is needed. Before launch, run a real data-flow test: form submission, CRM sync, AI chat, deletion request and vendor change, confirming the configuration matches the contract.
| Stage | Action | Evidence | Pause gate |
|---|---|---|---|
| Weeks 0–2 | Data map, fields, systems, vendors | Data-flow diagram, system list | Data location unknown: pause |
| Weeks 3–4 | Classification, volume, path | Classification/path record | Important data/CIIO: seek advice |
| Weeks 5–8 | Contracts, SCC/standard contract, assessment/certification | Contract/filing/remediation | No contract/mechanism: do not launch |
| Weeks 9–12 | Real data-flow test, deletion, archive | Test/deletion record | Config/contract mismatch: fix |
The 90-day window is an editorial suggestion, not a promise on approval/assessment timing; actual timing depends on the data, local authority and contract.
When should work pause and professional advice be sought?
Pause when important data, CIIO, large-scale sensitive information, an unknown recipient or a missing contract is involved, and seek legal/cyberspace/professional advice before launch.
Cross-border data is not a “fill in a template” task. Pause and seek advice when important data, critical information infrastructure, large-scale sensitive personal information, overseas law-enforcement/regulator requests, a vendor refusing to disclose subprocessors, missing contracts/assessments, or business teams sending data privately are involved. Do not write “assessment submitted/contract signed” as “approved/compliant”.
| Situation | Do first | Do not | Decision |
|---|---|---|---|
| Important data/CIIO | Identify, assess, seek advice | Use a standard contract directly | Pause/assess |
| Large-scale sensitive data | PIA, path, hardening | Only edit the privacy policy | Assessment/certification |
| Vendor hides subprocessors | Due diligence/contract | Launch first | Pause |
| No contract/mechanism | Add contract/mechanism | Use an NDA instead | Do not launch |
| Private data sending | Block, preserve evidence, train | Only verbal warning | Remediate |
| Submitted, not approved | Wait/remediate | Call it “compliant” | Pending |
Pause/decision gates are editorial suggestions, not legal conclusions; follow the law, local authority and professional advice.
Who should read this, who should not, and what decision does it support?
It fits manufacturers with an overseas website/CRM/AI customer service/overseas staff; it does not fit a purely domestic business with no personal data or a team unwilling to map data flows.
Who should read: manufacturers with an overseas website, overseas CRM, AI customer service, cross-border sales, overseas subsidiaries/staff, or plans to launch them; marketing, IT, legal, procurement and management. Who should not: a purely domestic business with no personal information/important data; no website/system owner; anyone seeking a “disclaimer template”; anyone expecting that “a signed contract equals compliance”. Decisions supported: whether to pause, which path to use, what contracts/records to fix first, how to accept a vendor, and how to explain the risk to management.
FAQ
Does a website form collecting overseas customer data count as a cross-border transfer?
Look at where the data goes. If data collected in China is sent to an overseas CRM, email/support platform or model API, it may be a transfer; if it is stored and processed only in China, domestic rules apply. Do not judge by the tool brand or server page alone.
Is it exempt if fewer than 100,000 people?
Not necessarily. Fewer than 100,000 non-sensitive personal-information records may be exempt from the three mechanisms (assessment, standard contract/certification), but notice, consent, a personal-information impact assessment and other obligations still apply; sensitive data, important data or special scenarios may differ.
How do we choose between a standard contract and a security assessment?
Use data type and annual cumulative volume: important data/CIIO, 1M+ non-sensitive or 10k+ sensitive usually require assessment; 100k–1M non-sensitive or <10k sensitive may use a standard contract/certification. The current rules and local authority govern.
What should we check with an overseas SaaS/cloud support vendor?
Check data centres, subprocessors, remote access, backups, logs and deletion; the contract should cover the cross-border mechanism, DPA, breach notice and termination. Do not rely on a Chinese interface or a sales claim that “data is local”.
Do GDPR and China's rules both apply?
If EU data subjects are involved, usually both need review: the China transfer path plus GDPR lawful basis, notice, transfer mechanism/TIA/DPA. They are not alternatives; applicability depends on legal advice.
How long is an assessment valid, and what if things change?
A data-export security assessment result is generally valid for three years; an extension can be applied for before expiry under the rules. If the data, recipient, purpose or path changes materially, reassess/update the record rather than relying on the old result.
Bottom line
For cross-border data at a manufacturer going global, map the website, CRM, AI customer service and supplier flows first; then choose assessment, standard contract/certification or an exemption by personal-information/important-data type and volume. Check China and GDPR together, keep contracts, records and actual configuration aligned, and never write “submitted/signed” as “compliant”.
Method and limits
This article is public regulation, official pages and editorial method, not legal advice, a compliance audit or a filing/assessment promise for any company, system, contract or data flow. It uses no unpublished customer data, contracts or system screenshots; thresholds, paths and the 90-day plan are editorial summaries, and applicability must be confirmed under current law, the local cyberspace authority, the contract and professional advice. Laws and platform rules change; the current text governs.
Sources
Information is current to 2026-10-29; each official page governs its own scope, version and terms.
- Provisions on Promoting and Regulating Cross-Border Data Flows (22 Mar 2024): CAC. Reference for paths, cumulative thresholds, exemptions and FTZ negative lists; current text and local authority govern.
- Measures for the Standard Contract for Personal Information Export (22 Feb 2023): CAC. Reference for standard-contract applicability, conclusion/filing and performance; no template or legal advice.
- Measures for Data Export Security Assessment (7 Jul 2022): CAC. Reference for assessment applicability, materials and process; confirm current requirements.
- European Commission, Data protection: commission.europa.eu. GDPR and EU data-protection framework reference; not a compliance conclusion for a specific flow.
- European Commission, Standard Contractual Clauses (SCC): commission.europa.eu. EU transfer-tool reference; applicability depends on legal advice and the contract.