Automotive Data Security

Automotive data security refers to the systematic technical and management measures implemented throughout a vehicle's entire lifecycle—spanning design, production, sales, operation, and maintenance—to safeguard vehicular data, personal information, and critical data from unauthorised access, leakage, tampering, or destruction. It serves as the bedrock for the development of the intelligent connected vehicle (ICV) industry and represents the practical execution of the Data Security Law and the Personal Information Protection Law within the automotive sector.

Data Scale and Risk Background

The data logging capability of modern intelligent connected vehicles far surpasses that of conventional cars. A single connected vehicle can generate approximately 10TB of data daily, which is 5 to 10 times higher than that of a traditional internal combustion engine (ICE) vehicle. This data encompasses sensitive information such as vehicle telematics and driving routes, pedestrian footage, surroundings, and geolocation data, posing severe leakage risks with wide-reaching security implications. Inadequate data governance could compromise individual privacy, public safety, and even national security.

Globally, automotive data breaches have triggered alarm bells on multiple occasions. In 2023, an operational error at Toyota exposed the vehicular data of over 2.15 million Japanese users, affecting its entire customer base registered on the brand's primary cloud service platforms since 2012.

Regulatory and Standards Framework

China has established a multi-tiered automotive data security governance framework structured around "laws + administrative regulations + ministerial rules + industry guidelines".

The core legal framework comprises the Data Security Law, Cybersecurity Law, Personal Information Protection Law, and the Regulations on Network Data Security Management, forming the foundational "three laws and one regulation" that govern data classification, critical data protection, and personal information rights.

Sector-specific regulations commenced with the Several Provisions on Automotive Data Security Management (Trial Implementation) in 2021, laying the initial groundwork for sector oversight. Building on this, the mandatory national standard GB 44495-2024 Technical Requirements for Vehicle Cybersecurity will take effect on 1 January 2026, defining automotive cybersecurity management system requirements alongside technical mandates for external connectivity, vehicle communications, software updates, and data security. Concurrently, the National Technical Committee of Auto Standardization is formulating the recommended national standard Specification for Data Security Management Systems of Intelligent and Connected Vehicles, covering end-to-end data lifecycle security and operational risk management.

At the provincial enforcement level, the Fujian Communications Administration and the Provincial Department of Industry and Information Technology jointly issued a directive in July 2026, requiring vehicle-to-everything (V2X) enterprises to strengthen data management protocols, identify and catalog critical data according to the Guidelines for Outbound Transfer Security of Automotive Data (2026 Edition), and conduct mandatory annual security risk assessments for critical data processing.

2026 Edition: Guidelines for Outbound Transfer Security of Automotive Data

On 30 January 2026, eight government bodies—including the Ministry of Industry and Information Technology (MIIT), Cyberspace Administration of China (CAC), National Development and Reform Commission (NDRC), National Data Administration (NDA), Ministry of Public Security (MPS), Ministry of Natural Resources (MNR), Ministry of Transport (MOT), and State Administration for Market Regulation (SAMR)—jointly issued and enforced the Guidelines for Outbound Transfer Security of Automotive Data (2026 Edition) (the "Guidelines"). Superseding the 2021 trial provisions, this landmark policy transitions cross-border automotive data governance from high-level principles to granular, scenario-driven enforcement.

The scope of regulated entities has widened significantly. The Guidelines define "automotive data processors" as any organisation or individual independently determining processing purposes and methods. This extends beyond car manufacturers (OEMs) to include auto parts and software suppliers, telco operators, autonomous driving service providers, platform operators, authorised dealerships, service centres, and mobility operators.

Scenario-based classification for critical data represents the core breakthrough of the Guidelines. Focusing on five primary operating scenarios—R&D and design, manufacturing, automated driving, software updates (OTA), and connected operations—the earlier 49 draft classifications have been streamlined into 27 categories across 51 items with explicit qualification metrics. For instance, in real-world testing, data gathered from more than 100,000 vehicles operating domestically, or raw captures exceeding 2,000 hours of video or 10 million images, are formally classified as critical data.

Cross-border data export mechanisms follow a three-tier regulatory path: mandatory outbound data security assessments apply when exporting critical data, or cumulative personal data of over 1,000,000 individuals, or sensitive personal data of over 10,000 individuals. For cumulative exports involving 100,000 to 1,000,000 individuals (excluding sensitive data), compliance can be achieved via standard contractual clauses or certification, while specific conditions qualify for statutory exemptions.

Among the nine exemption categories, items seven to nine introduce industry-specific waivers: security vulnerability data, incident response data, and OTA software source code exported strictly to rectify software flaws, manage incidents, or execute vehicle recalls are exempt from formal security assessment filings, provided they have been officially logged with authorities. Qualifying for these waivers requires meeting two prerequisites: the export must strictly serve vulnerability patching, incident resolution, or defect remedies; and the data must be formally reported or filed in advance with relevant bodies like the MIIT or SAMR.

Enterprise Security Compliance Mandates

The Guidelines establish a comprehensive enterprise compliance framework across four core pillars: management protocols, technical safeguards, log administration, and incident response.

Administratively, enterprises must designate dedicated outbound data management departments and security officers, backed by internal approval workflows. Technical safeguards mandate validation and commercial cryptographic technologies to secure data in transit, alongside continuous security monitoring and alert logging for cross-border communications and system activities. Log management requires tamper-proof preservation of network traffic logs, user operation logs, and security alert records for at least 3 years. Incident response dictates that organisations maintain clear containment procedures to identify, remediate, and report non-compliant export activities swiftly.

In day-to-day operations, principles such as "raw data remains on-premise" and "data minimisation" have become industry standards. For example, NavInfo has implemented an end-to-end security architecture across data capture, transmission, storage, and processing for autonomous driving development. By integrating in-vehicle compliance SDKs for real-time anonymisation and utilising digital certificates with encryption, OEMs can safely utilise de-identified data strictly within regulated environments.

Key Challenges and Future Outlook

Automotive data governance continues to grapple with practical industry hurdles. Challenges surrounding cross-entity data sharing in smart driving, multi-modal data anonymisation, and end-to-end operational security remain prevalent. Comprehensive industry standards are still needed for the retention, utilisation, and deletion of sensitive telemetry and pedestrian footage. On the compliance front, thresholds for identifying critical data require ongoing refinement, while regulatory ambiguities—such as whether a Vehicle Identification Number (VIN) constitutes personal data during cross-border transfers—await clearer legal clarity through industry practice.

Looking ahead, the sector is moving toward a unified "laws + administrative rules + technical standards" tripartite regulatory ecosystem. International standards for cross-border automotive data exchange are also evolving in parallel. By leveraging the high-profile automotive sector as a testing ground, these Guidelines introduce a practical Chinese framework for data security, laying the foundation for balanced, reciprocal, and cooperative global standards.