Compliance Governance in an Era of Fragmented Cross-Border Data Regulation
Abstract
Fragmented cross-border data regulation has become a defining governance challenge for in-house legal teams. This article contrasts China’s regulator-led, the EU’s rights-first and the US’s market-driven models, showing why their competing priorities of security, rights and flow defeat any single global compliance solution. It argues that businesses should embed data governance at the “zero-to-one” stage of cross-border projects and scale it into an adaptive enterprise framework built on local closed-loop operations, controlled sharing with headquarters and the export of technical capability rather than raw data. Dispute readiness belongs within that framework. Using English litigation as a representative example, the article examines the conflict between English disclosure obligations and Chinese restrictions on providing data for foreign proceedings under Article 36 of the Data Security Law and Article 41 of the PIPL, traces the English courts’ approach since Bank Mellat v HM Treasury, and closes with practical steps for in-house counsel.


