Data localization hurts foreign investment and brings potential economic advantages to domestic corporations relative to foreign corporations. This leads to the argument that data localization violates the national treatment principle in international investment treaties. By applying the ‘three-step’ approach to assess the legality of data localization with respect to the national treatment principle, this article finds that the legality of data localization depends on certain circumstances, including the domestic catalogues of foreign investment, the definition of data localization in domestic legislation, and whether international investment treaties explicitly or implicitly incorporate data protection through exceptions for the protection of the state's essential security interests, public order, or public morals. China's acceleration of its legislation processes to regulate cross-border data transfer has significant implications for the negotiations and modifications of Chinese international investment treaties.