This Article illustrates the subtle relationship between the free flow of personal information and privacy protection. It then examines the present legal framework of cross-border data flow and intends to provoke further reflection on the field. Additionally, this Article suggests proposals for China to protect privacy while simultaneously promoting the development of cross-border e-commerce. First, with respect to the relationship between the free flow of personal information and privacy protection, research shows that the transfer of personal information has significant influence on an economy. Despite this, it may trigger concerns over privacy protection. Considering that, different national policies have created obstacles to the transfer of said data, while hindering the economy development. Hence, this Article focuses on the development of cross-border e-commerce to explore the protection of privacy of personal information in the process of cross-border transferring, which inherently includes both the international and domestic angles. Second, this Article compares different international, regional and domestic regulations and draws conclusions. Multilateral legislation has three intrinsic deficiencies. The first deficiency is the divergence in values that augments different paradigms. There are currently two legislative paradigms, one that emphasizes privacy protection and the other that emphasizes economic development. These two paradigms have two different approaches to regulating data flow. It impedes the formation of a widely-accepted international rule The second deficiency in multilateral legislation is the imbalancebetween “soft law” and “hard law”. This will hamper governance by rule of law for inherent defects of both rules. Third is the possibility that the regulations will have force but lack pertinence, generality and operability. As to domestic laws, they can be classified into 3 categories: “adequate protection”, “data controller’s ensurence” and “subject’s consent”. Each mode has its own advantages and disadvantages. The European Union, the United States and China represent one of the categories to regulate cross-border flow of personal information. Finally, This Article suggests that China regulate the transfer of personal information from three dimensions. First, China should construct legal regulations at the unilateral, bilateral and multilateral levels with a healthy interaction between the three. Second, concerted efforts between Chinese market participants are needed: individuals must nurture legal awareness; enterprises must work on capacity building; and the government must enhance the governance framework for information privacy. Third, China should try to strike a balance between national security, economic development and privacy protection without bias in favor of one or the other. The innovative part of this Article is that it chooses the perspective of the development of cross-border e-commerce to explore the international flow of personal information and puts emphasis on privacy protection under that data flow. As a new form of international trade, cross-border e-commerce has incomparable advantages over traditional trade and promotes a new reform in international trade. And the cross-border data flow is of great significance to it. Hence, it is significant to seek countermeasures to enhance the coordination and progress between difference rules.Further, it enumerates the relative rules and makes detailed comparisons between them. Practically, China is initiating the “Digital Belt and Road Initiative” and, being one of the largest markets for cross-border e-commerce, researching on privacy protection under data flow is inevitable.