“Personal information and important data” collected and generated in China by critical information infrastructure operators must be stored domestically. Transfer abroad is possible after a security assessment and approval. The 2022 Measures for Security Assessment for Outbound Data Transfer provided more clarity on the scope and process for security assessments. 