Moving Data Across the Border: What a Small Foreign Company Needs to Do
China Field Notes · by Daona · 13 min read
Since March 2024, most small foreign companies in China no longer need a government filing to send ordinary business data to headquarters. "No filing" is not the same as "no rules". Know which exemption you rely on, write it down, and keep counting.
Your WFOE's payroll is local, but headquarters runs a global HR system in Frankfurt. Leads go into a CRM hosted in the United States. The Singapore finance team logs into the Chinese ERP every month. Each is a cross-border data transfer (数据出境).
In March 2024, the Cyberspace Administration of China (国家互联网信息办公室, CAC) issued the Provisions on Promoting and Regulating Cross-border Data Flows (促进和规范数据跨境流动规定), taking many common flows out of the filing system. The Network Data Security Management Regulations (网络数据安全管理条例) followed from 1 January 2025, compliance audit measures from 1 May 2025, and certification measures from 1 January 2026.
The Personal Information Protection Law (个人信息保护法, PIPL), the Data Security Law (数据安全法) and the Cybersecurity Law (网络安全法) sit at the top. Under PIPL Article 38, personal information may leave China through one of three routes, unless an exemption applies:
| Route | What it involves |
|---|---|
| Security assessment 数据出境安全评估 | Through the provincial CAC to the national CAC; large volumes, important data, critical infrastructure |
| Standard contract 个人信息出境标准合同 | CAC template signed with the recipient, filed with the provincial CAC |
| Certification 个人信息保护认证 | By a qualified body; detailed measures from 1 January 2026 |
What counts: not only sending files. Regulators treat remote access from abroad to data stored in China as a transfer, as well as collecting Chinese data straight into a system hosted overseas.
| Exemption | Watch out for |
|---|---|
| Trade, transport, academic, manufacturing data with no personal information or important data | Customer contacts are personal information |
| Data collected abroad, processed in China, sent back | No Chinese PI added |
| Necessary for a contract with the individual (shopping, delivery, payment, bookings, visas) | Read strictly; marketing analytics not covered |
| Cross-border HR management under lawful labour rules | Employees, and only what is necessary |
| Emergencies protecting life, health or property | — |
| Non-sensitive PI of fewer than 100,000 people since 1 January | Any sensitive PI takes you out |
The count is cumulative from 1 January each year, and people covered by the HR and contract exemptions are not counted. Sensitive personal information (敏感个人信息) (PIPL Art. 28) includes biometrics, religious beliefs, specific identities, health data, financial accounts, location tracking and any data of children under 14.
| Since 1 January (non-CII operator) | Route |
|---|---|
| Non-sensitive PI < 100,000, no sensitive PI | Exempt |
| Non-sensitive PI 100,000 to under 1 million, or sensitive PI < 10,000 | Standard contract or certification |
| Non-sensitive PI > 1 million, or sensitive PI > 10,000 | Security assessment |
| Any important data | Security assessment |
Critical information infrastructure operators need an assessment regardless of volume. Important data (重要数据) is set by sector catalogues and notification; data not notified or publicly listed as important need not be declared as such.
· Map the flow — what data, whose, how many, which recipient, why, how long.
· Impact assessment (个人信息保护影响评估) under PIPL Art. 55; keep it at least three years.
· Sign the CAC template, unaltered; extra terms only if they do not conflict.
· File with the provincial CAC within 10 working days of the contract taking effect. Procedures vary by province.
· Re-file on change — new purpose, data categories, recipient or retention.
A security assessment is a substantive review; an approval is valid for three years and can be extended. Certification covers the same band as the standard contract from 1 January 2026; practical guidance is still developing.
An exemption removes the filing, not the PIPL
· Tell people the recipient, purpose, data and how to exercise rights (Art. 39)
· Separate consent (单独同意) where consent is the legal basis
· Impact assessment for overseas transfers generally
· Record the exemption, the reason and your annual count
The compliance audit measures (个人信息保护合规审计管理办法), in force since 1 May 2025, require processors of PI of more than 10 million people to audit at least every two years; regulators may order audits after incidents or where risk is significant. The 2025 Regulations restate the exemptions and add duties for processors above 10 million individuals.
Pilot free trade zones (自由贸易试验区) may publish negative lists (负面清单); data not listed can leave without a route, for companies registered in the zone. Tianjin went first in 2024, then Beijing and, in February 2025, Shanghai (FTZ and Lingang). Lists are sector-specific — check registration and sector coverage first.
Under the Data Security Law (Art. 36) and PIPL (Art. 41), data stored in China may not be given to foreign courts, regulators or law enforcement without approval from the competent Chinese authorities. Route litigation holds, investigations and regulator requests through counsel before anything leaves.
A Shanghai consumer-products WFOE with 60 employees; not a CII operator; no notified important data. One calendar year:
| Flow | People | Treatment |
|---|---|---|
| Employee records to global HR | 60 | HR exemption, if necessary |
| Orders shipped by overseas partner | 40,000 | Contract exemption |
| CRM: distributor contacts | 3,000 | Counted |
| Marketing analytics | 120,000 | Counted |
| Total counted | 123,000 | 3,000 + 120,000 |
Illustrative. Not based on any real company.
123,000 exceeds 100,000, so the counted flows need the standard contract or certification. If analytics ran on de-identified data in China with only results sent abroad, the count would fall to 3,000 and the volume exemption would apply. Payroll bank details are sensitive: keep them in China unless headquarters genuinely needs them.
Map before you file. The largest flow is often not the one you worried about.
Use exemptions deliberately, and write them down — a reason and a number.
Minimise. De-identify, aggregate, or keep processing in China.
Watch the counter. A campaign or new app can push you over mid-year.
Use licensed help where it matters. Assessments and filings are commonly prepared with law firms and data compliance providers. Daona is not a law firm or certification body; we coordinate and introduce, and providers' fees are settled by the client directly at cost.
"Data rules no longer apply to small companies." The filing burden fell; the PIPL did not.
"HR data is always exempt." Only what cross-border HR management needs.
"Remote access is not a transfer." Regulators treat it as one.
"One bank card number doesn't matter." Any sensitive PI ends the volume exemption.
"We count once at setup." Counting restarts each 1 January and accumulates.
"HQ can hand data to a foreign court." Not without Chinese approval.
Your checklist
☐ Data map: what, whose, how many, to whom, why
☐ Include remote access from abroad
☐ Record the exemption for each flow and why
☐ Count from 1 January; flag sensitive data
☐ Update notices; separate consent where needed
☐ Complete the impact assessment
☐ Over threshold: standard contract, filed within 10 working days
☐ Check FTZ negative lists if registered in a zone
☐ Foreign authority requests go through counsel first
☐ Reply SETUP for our Entity Setup Checklist
Rules as of October 2026. This column provides general information, not legal advice. Data mapping, impact assessments, standard contract filings and security assessments should be handled with your legal team, a law firm or a qualified data compliance provider; thresholds and local filing procedures should be confirmed with the provincial cyberspace administration. Government fees and licensed firms' fees are settled by the client at cost.
China Field Notes · by Daona