Cross-Border Data Compliance
AMT supports common cross-border transfer routes: a completed CAC standard-contract filing, Shanghai FTZ negative-list scenarios and related review materials for carbon / ESG / traceability data transfers.
- Route 1
- CAC security assessment (as needed)
- Route 2
- Standard-contract filing (done)
- Route 3
- FTZ negative list (scenario support)
- Data centre
- AMT Shanghai data centre
AMT’s cross-border framework
Cross-border transfers from China depend on data type, scale and recipient scenario. AMT can support standard-contract filing, FTZ negative-list and security-assessment materials.
- CAC security assessment
For large-scale or important-data transfers, AMT can support route assessment and material preparation as needed.
- CAC standard-contract filing ★
Filing completed for common personal-information transfer scenarios, paired with a PIPIA.
- Shanghai FTZ negative-list pilot ★
For applicable scenarios, the negative-list route can support more efficient transfer of off-list data.
- PI protection certification
An optional route for certain personal-information transfers.
Example data-flow paths
- 1Via the standard contract
Captured in China → AMT Shanghai data centre → overseas recipient (under the CAC SCC + PIPIA).
- 2Via the negative list
Captured in China → AMT Shanghai data centre → overseas recipient (off-list data flows freely).
Tiered transfer management
Different data tiers follow different workflows so each maps to the right route and controls.
| Data type | Transfer route | Additional controls |
|---|---|---|
| General data | Negative list / SCC | Encrypted transfer + audit logs |
| Important data | CAC assessment (as needed) | Classification + necessity justification |
| Personal information | SCC + PIPIA | Separate consent + minimisation |
| Sensitive personal information | SCC / certification + PIPIA | Heightened consent + extra encryption |
Customer vs. AMT responsibilities
Customer (controller)
Owns the data; responsible for classification, transfer purpose and lawful basis, and obtaining consent from data subjects.
AMT (processor)
Provides compliant transfer routes, encrypted transfer and audit logs; processes on instruction and supports transfer obligations.