The regulation of cross-border data fl ows constitutes a fundamental issue in the governance of global digital trade. WTO law stands out as the most appropriate framework for reconciling the disparate norms on cross-border data fl owing across jurisdictions. The regulatory orientations of cross-border data fl ows fall into two categories: free data fl ow and secure data fl ow, while the regulatory approaches include two types of data localization measures, namely strict data localization requirements and conditional data flow mechanisms. Policy objectives such as data privacy protection, online consumer protection, cyberspace governance, and digital industrial policy can serve as the primary basis for judging the compatibility between WTO law and data localization measures. Normatively speaking, WTO law ought to encompass data localization measures that serve legitimate public policy objectives; further, it should refine its regulatory rules by closely aligning with the respective policy objectives underlying these measures, guided by such principles as hybrid regulation and digital trust.