The international rule-making regarding cross-border data flows revolves around the conflict and coordination between data sovereignty and data freedom, both of which are core principles of data governance that must be balanced in policy formulation. The Digital Economy Partnership Agreement (DEPA), while advocating for the liberalization of cross-border data flows in principle, also includes exception clauses for cross-border data fl ows to achieve a balance between data sovereignty and data freedom. As an applicant for DEPA accession, China maintains multiple restrictions on cross-border data fl ows. Therefore, China must grasp and appropriately leverage the policy space provided by the exception clauses to ensure that its data regulatory framework is consistent with DEPA obligations. However, DEPA’s exception clauses for cross-border data fl ows suffer from ambiguity in wording and uncertainty in application, which may result in interpretative disputes and even abuse. Contracting parties may adopt necessary measures based on public policy objectives while complying with DEPA’s overall data governance framework to safeguard their national data sovereignty and security. To address these challenges, China should adhere to the principle of good faith interpretation and apply the exception clauses in a prudent and proportionate manner. It should also clarify its list of “non-conforming measures” and improve the operability of its security assessment mechanism. These steps aim to enhance the clarity of DEPA’s exception clauses and the predictability of their application, promote greater alignment between China’s data regulations and the agreement, and facilitate digital trade development.