A security assessment is necessary before certain types of data can be transferred abroad. In March 2024, the Cyberspace Administration of China adopted the Regulations on Promoting and Regulating Cross-border Data Flow which in Article 7 clarified what types of data must undergo this assessment. It applies to two situations: 1. Any important data and personal data shared by critical information infrastructure operators (CIIO); and 2. Important data or personal data of 1 million or more people or the sensitive personal information of 10,000 or more people overseas since January 1 of that year transferred by data handlers other than CIIOs. Note that the Regulation clarified what types of data transfers do not require a security assessment. These include three types of data: firstly, data collected and generated in international trade, cross-border transportation, academic cooperation, cross-border production and manufacturing, marketing activities can be provided to overseas entities, excluding personal information or important data. Secondly, personal information transfered from overseas to China for processing and then provided to overseas entities, without introducing domestic personal information or important data during the processing; Lastly, the personal information provided in scenarios such as cross-border shopping, cross-border delivery, cross-border remittance, cross-border payment, cross-border account opening, flight and hotel booking, visa processing and examination services.