Cross-border data flows is a crucial factor in digital economy. Article 12.14 (2) and Article 12.15 (2) in RCEP stipulate the prohibitive norms on data localization, aiming to ensure the data is transferred freely. Except some other clauses indirectly stipulate some circumstances for excluding the use of the prohibitive norms, Article 12.14 (3) and Article 12.15 (3) directly stipulate the exception clauses of data localization, i.e., the clause of legitimate public policy, horizontal provisions, and clause of the essential security interests. The WTO case-laws show that the aforesaid concepts should be interpreted by the Parties according to their own reality. The norms on “anti-discrimination” and “anti-disguised restriction” are to prevent the “clause of legitimate public policy” from being abused. To understand these norms, we need to evaluate the substantive purposes of the concrete measures launched by the states, and then clarify the relations between aforesaid purposes and the legitimate public policy objective.