Connected Vehicle and Automotive Data Compliance in China: Orientation

Data types that drive compliance design

• Personal information — drivers, passengers, phone pairings, biometrics, voice
• Vehicle / operations data — location trajectories, video, diagnostics (may be important data in some contexts)
• Maps / geospatial — elevated sensitivity; specialised mapping rules may apply
• R&D fleets — test vehicles still generate regulated data

Core workstreams

1. Data inventory by ECU/feature and storage location
2. Classification: PI vs important data vs other
3. Onshore processing defaults for high-risk sets
4. Outbound pathway design if global clouds are required
5. Security assessment / filing themes where triggered
6. Supplier contracts for telematics and cabin AI vendors
7. Incident response for breaches and unsafe software updates

OEM / supplier checklist

• [ ] Feature-level data map (what leaves the car, where it goes)
• [ ] China privacy notice and in-vehicle UX consents
• [ ] Cross-border transfer status for each global system
• [ ] Cabin AI / recording features reviewed under AI + privacy rules
• [ ] Tier-1 data processing agreements updated
• [ ] Export-control interface for ADAS hardware (tracker)

Counsel

EV hub   PIPL guide   Find counsel