Lots of controversies surround the legality of data localization. The report takes stock of current practices of data localization around the world and builds up a model of strictness for data localization measures. Then guided by the requirements of appropriateness and necessity between ends and means，this report construct a theory on the legitimate limits on data localization，and then establish a framework for security assessment on cross-border data transfers.