China has published two mandatory national standards addressing the security of geospatial data generated by intelligent and connected vehicles: GB 48319—2026, Basic Requirements of Security Processing for Intelligent and Connected Vehicle Spatio-temporal Data, and GB 48320—2026, Basic Security Requirements for Spatio-temporal Data Sensing System of Intelligent and Connected Vehicle.

Issued on September 28, 2026, both standards take effect on October 1, 2027, with additional application schedules specified in their implementation clauses. Proposed and administered by the Ministry of Natural Resources, they connect vehicle data processing and sensing-system design with China’s surveying, mapping and geographic information security framework. Official standards catalogue

Data processing and system requirements

Both standards apply to intelligent and connected vehicles sold to the public and operating within China. GB 48319 regulates the collection, storage and transmission of five data categories: vehicle trajectories, point clouds, images, inertial navigation data, and mapping data containing absolute coordinates.

Its scope excludes research and development test vehicles and data-collection vehicles. It also excludes downloaded geospatial data, data received from other vehicles, and onboard data immediately collected, used and discarded without non-volatile storage or offboard transmission. These exclusions concern this standard’s scope and do not remove obligations under other applicable rules.

Vehicles must not identify, extract or record the names of specified military and other sensitive facilities. The standard clarifies that “identification” here does not include a camera’s capture of images or video.

Trajectory and mapping data must undergo nationally recognised geographic information confidentiality processing before storage or offboard transmission. For stored point clouds, trajectory-associated imagery and mapping data, continuous road coverage must not exceed 10 kilometres, with cumulative coverage capped at 350 kilometres. A single transmission of these categories must not exceed 10 kilometres of continuous road coverage. Offboard transmission destinations must be within China.

GB 48320 translates these controls into system functionality. Its definition covers sensors, domain-controller storage units, telematics terminals and onboard units. The confidentiality-processing module must operate before storage and transmission modules. It also specifies a gravity-acceleration collection accuracy restriction, storage controls, external-interface access controls, and transmission protection referencing GB 44495—2024, Technical Requirements for Vehicle Cybersecurity.

Communication services must be provided by operators holding telecommunications business licences, or use nationally permitted frequency bands. Transmission destinations must be explicitly specified and located within China. The destination clause contains an exception for vehicle-side direct communication applications; this should not be interpreted as a blanket exemption from the standards’ other requirements.

Application schedules and testing

The standards distinguish their effective date from the dates when particular products must comply.

Under GB 48319, vehicle products publicly listed, or imported vehicles certified, before the effective date begin applying the requirements in the 25th month after that date. Products listed or certified afterwards begin in the 13th month. GB 48320 similarly provides a 13th-month schedule for systems newly applying for type approval and a 25th-month schedule for systems already approved.

GB 48320 also requires testing of sensor functions and accuracy, processing-module sequencing, storage, access controls, transmission destinations and communication frequencies. Sensor manufacturer, model, surveying functions and accuracy, together with offboard destinations, determine whether systems constitute the same type, subject to the direct-communication exception.

BESTAO Analysis & Recommendations

For the automotive semiconductor industry, BESTAO considers that these requirements may influence component selection and system integration. GNSS, IMU, radar, camera-processing and domain-controller suppliers should help customers document sensor capabilities, accuracy and data flows. Processing platforms may need to support confidentiality processing before persistent storage or transmission. The standards establish vehicle and system requirements; they do not themselves impose a separate chip certification obligation or domestic chip sourcing requirement.

For automotive software providers, the main implication is architectural. Logging, diagnostic uploads, mapping functions and fleet-data collection should be reviewed against data-category, processing-order and road-coverage restrictions. Suppliers should assess whether debugging or crash-recording functions persist data that developers otherwise consider temporary. General cybersecurity encryption should not be assumed to satisfy the separately specified geographic information confidentiality-processing requirement.

For the communications industry, telematics suppliers, connectivity providers and cloud integrators should examine configured receiving endpoints, communication services and transmission protection. Changing an offboard destination may affect the same-type assessment, making endpoint governance relevant to product change management. Overseas engineering access and global cloud workflows also warrant review against the standards and wider data rules.

BESTAO recommends that manufacturers and suppliers map data flows from sensors through storage and communications, assign compliance responsibilities, and prepare evidence demonstrating processing order and system behaviour. Approval status and the applicable implementation schedule should be confirmed early, while supplier contracts and change-control procedures should address sensor substitutions, software updates and destination changes.

For Chinese or English versions of these two standards, or guidance on their implications for product design, system development and compliance in China, please contact BESTAO.