目前我国数据跨境流动的监管体系已经初步形成，在原则上鼓励数据自由流动，同时对于个人信息、重要数据和特定行业的数据做出了本地化和出境安全评估等保留措施，而这些措施在我国申请加入DEPA的过程中面临质疑和挑战。包容性分析的要点是检验限制措施能否满足DEPA例外条款中的三项要求。从正当事由的角度，我国保护个人信息和维护公共秩序的限制理由在国际上广受认可，不存在较多争议。从限度相符性的角度，DEPA并未采纳严苛的必要性测试标准；即使本地化措施在技术上存在不足，但是仍然对于个人信息和重要数据的保护不可或缺。从非歧视性的角度，我国法律在立法层面对中外主体一视同仁，但在实施过程中对外国主体有难以避免的不利影响，是否构成歧视则需要进行个案判断。目前的挑战在于立法的碎片化导致各法规之间难衔接一致，关键概念的模糊定义催生了口袋式的兜底条款，破坏了监管体系的自洽性并不当地拓宽了限制数据跨境的范围。在后续立法中，需要进一步明确重要数据的认定标准与认定资格，监管部门在适当时可以简政放权并针对特定国家和地区调整目前的跨境规则。

 The regulatory system of cross-border data flows has now beenpreliminarily formed in China, which encourages the free flow of data inprinciple, but makes reservations such as data localization and outboundsecurity assessments for personal data, important data and data within specificindustries. These measures have been misunderstood and challenged during ourapplication to join the DEPA, and whether they can meet three requirements ofthe DEPA exception clause is the key point of inclusiveness analysis. From theperspective of legitimate objective, the protection of personal information andthe maintenance of public order are grounds widely recognized and there arebarely no controversial. From the perspective of proportionality, the DEPA doesnot adopt necessity test standard. Even though the localization measures arestill technically inadequate, they can still prove indispensable for theprotection of personal data and important data. From non-discriminatoryperspective, China treats domestic and foreign subjects equally at thelegislative level, but there are unavoidable adverse effects on foreignsubjects in the implementation of the law, which need to be determined in acase-by-case way. The main challenge is that legislative fragmentation has ledto a lack of consistency within regulations, and vague definitions of keyconcepts have given rise to catch-all provisions. This undermines theself-consistency of the regulatory system and incorrectly broadens the scope ofrestrictions on cross-border data flows. In subsequent legislation, it isnecessary to further clarify the criteria and qualifications for therecognition of important data, and the regulator may, where appropriate,simplify and adapt the current cross-border rules for specific countries andregions.