Data stayed in China and still left: PIPL’s remote access problem

The week

China adopted a law in August 2021 that turned a routine arrangement into a legal question. For years, many multinational companies ran their China operations on the same global systems as everywhere else. An employee record in Shanghai sat in the same HR platform as one in London. A customer file in Beijing could be opened by a support agent in Manila. That arrangement was efficient.

On August 20, 2021, the Standing Committee of China’s National People’s Congress, the body that passes most of China’s national laws, adopted the Personal Information Protection Law, known as the PIPL. It took effect on November 1, 2021. It was China’s first comprehensive personal information law and followed the Data Security Law, in force from September 1, 2021. Personal information means any information that relates to an identifiable person: a name, a phone number, an account history, a face.

How the law got there

The PIPL did not arrive without warning. A first draft was published for comment in October 2020 and a second in April 2021. The August vote was the third reading. Multinationals had watched the drafts, but many had treated them as a privacy project to be finished once the text settled.

The law also built on an older foundation. The Cybersecurity Law, in force since June 2017, already required operators of critical information infrastructure to store personal information and important data collected in China inside the country. Sector rules went further in places. Banks had faced a People’s Bank of China expectation since 2011 that personal financial information collected in China be stored and processed there. Life sciences companies already worked under China’s regulations on human genetic resources, which restricted the export of genetic material and related data.

The political mood that summer mattered as much as the text. In early July 2021, days after the ride-hailing company Didi listed its shares in New York, the CAC opened a cybersecurity review of it and ordered its app removed from Chinese app stores. On July 10, the CAC proposed revising its cybersecurity review rules so that platforms holding the personal information of more than a million users would need a review before listing abroad. Data had become a national security question in plain view.

What the law said

The PIPL set legal bases for processing, meaning the approved reasons an organization may use someone’s data, such as consent or the need to perform a contract. It added a basis that Western readers noticed: processing necessary for human resources management under lawfully adopted labor rules and collective contracts. It gave individuals rights over their information, including the right to withdraw consent. It set stricter rules for sensitive personal information. That category includes financial accounts, medical and health data, a person’s whereabouts, the information of children under 14, and biometrics, the physical traits like fingerprints and faces that systems use to recognize people. And it placed obligations on some organizations outside China that process the information of people in China, including a duty to appoint a representative or set up a dedicated entity there.

The section that kept general counsel up at night concerned borders. Personal information could leave China only through one of three routes: a security assessment by the Cyberspace Administration of China (CAC), the country’s main internet regulator; certification by a specialized body; or a standard contract, a government-approved set of terms signed by sender and recipient. Transfers generally required separate consent from the individuals concerned, after they had been told who the overseas recipient was and what it would do. They also required a personal information protection impact assessment, a documented review of the risks, with records kept for at least three years.

Some organizations faced a stricter rule still. Operators of critical information infrastructure, such as key networks in finance, energy and public services, and processors above volume thresholds the regulator would set, had to store personal information collected in China within China. This is data localization: a requirement that the data physically live inside the country. A separate article barred handing personal information stored in China to foreign courts or law enforcement without approval from Chinese authorities.

Penalties for serious violations could reach RMB 50 million or 5% of the prior year’s turnover, with separate fines for the responsible managers.

The same week, two more rules

The PIPL was not the only instrument that week. On August 17, the State Council published regulations on the security protection of critical information infrastructure, effective September 1. They left it to sector regulators to identify which operators counted, which meant many banks and insurers could not yet be sure whether the strictest localization rule applied to them. On August 20, the CAC and four other agencies issued rules on automobile data security, effective October 1, which applied the same logic to data from connected cars.

Across boardrooms that week, the natural response was to ask where the servers were. It was the right first question, but not the last one.

Many multinationals first read the PIPL as China’s version of the GDPR, Europe’s General Data Protection Regulation, and the comparison holds for definitions, legal bases and individual rights. Its practical weight, though, fell on cross-border transfer. The timing made that harder. The European Commission had adopted new standard contractual clauses in June 2021. Many of the same privacy teams had spent the summer re-papering European transfers, so a second transfer regime arrived on desks that were already full.

Banks with China operations, insurers, and life sciences companies running trials or research there shared a first instinct. They wanted to localize: stand up in-country instances of HR, customer and research systems, and keep the data in Chinese data centers or cloud regions. An instance is a separate copy of a software system, running on its own. A cloud region is a cluster of data centers that a cloud provider operates in one geographic area; choosing a region in China means the data is stored there. The major Western cloud platforms run their China regions through licensed local partners, separately from their global regions, so even this first step meant new accounts, new contracts and often a different feature set.

That was necessary for many and sufficient for few. A transfer under the PIPL covers more than a file crossing a border. Regulators made clear that making personal information available to people or systems outside China counts too. An organization with every database in Shanghai can still be transferring data many times a day.

Personal information leaves through three distinct paths, and each needs its own architectural control: copies, where systems replicate data abroad; remote views, where people outside China read data that stays inside; and derived outputs, where reports, extracts and models built from the data travel instead of the data itself. The sections below first explain why the definition of transfer is so broad, then take each path in turn. They then follow one hypothetical firm through the mapping, and close with the operating-model trade-offs and what a complete program contains.

What “transfer” means once data lives in the cloud

Very little in a modern corporate system sits on a single machine in a single office. An HR system, a customer database or an email service is usually software run by a vendor, often called SaaS, for software as a service, and accessed through a web browser. The vendor stores the data in its data centers, keeps backup copies elsewhere, and synchronizes records between sites so the service stays fast and available.

Global companies typically set these systems up once, as a single global tenant, meaning one shared account for the whole organization. That is what lets a manager in New York see the whole workforce in one dashboard. It also means data from China is, by default, stored and processed wherever the global tenant lives.

The everyday analogy is a family photo album. Keeping the album in a house in Shanghai does not stop relatives abroad from seeing the photos. The album can be scanned and emailed, shown on a video call, or summarized in a note describing who appears in each picture. The album never moved. The information did.

The PIPL’s transfer rules rest on the same idea. Location of storage matters, but so does who can see the data, from where, and what is built from it and sent on.

Why the definition reaches so far

The breadth follows from the law’s purpose. China’s data laws treat personal information as a matter of national security as well as individual rights. A regulator with that view cares about the practical question of who abroad can learn what about people in China. Whether bytes crossed a border is secondary. A definition limited to physical storage would leave the most common forms of foreign access untouched.

The text left room for the broad reading. The law speaks of providing personal information to recipients outside China, a word wide enough to cover making data available, as the CAC later confirmed. The extraterritorial article also reaches processing done outside China to serve or analyze people inside it. An overseas team working on China customers’ data can therefore be within the law’s reach directly.

Why this differs from how Western teams were used to thinking

European transfer law also treats remote access from abroad as a transfer, so the concept was not new to GDPR veterans. What differed was the weight. Under the GDPR, a company could rely on its own transfer documents, signed internally and shown to a regulator only if asked. Under the PIPL, every transfer would need one of the mechanisms the state defined, and the largest would need a government assessment. A routine help desk practice could, above certain volumes, require a regulator’s approval.

US firms had a different starting point again. Outside a few sector rules, US law does not restrict exports of personal data at all. Many US-headquartered companies had never inventoried their data flows by country, because nothing had required it. For them, the PIPL was the first time location and access had to be documented as a pair.

Which organizations this reaches

The exposure varies by type of organization. A foreign bank with a locally incorporated subsidiary in China was likely to be treated as critical infrastructure or to cross the volume thresholds, and it already had its 2011 localization expectation. An asset manager or broker with a small representative office and a few hundred employees had mostly employee data and some client contacts. An insurer sat between the two. A pharmaceutical sponsor running trials at Chinese hospitals faced the PIPL, the human genetic resources rules and health data rules together.

Public bodies were less directly affected. Few US federal, state or local agencies process the personal information of people in China. Their exposure ran through research universities, public hospitals with Chinese collaborators, and vendors whose engineering or support teams worked from China. That last case reverses the usual direction, but it uses the same three-path vocabulary.

Copies: replication nobody designed

The most visible path is replication. Global HR platforms synchronize employee records to a headquarters instance. Customer relationship tools mirror account data to a global tenant. Backups are written to a regional data center in Singapore. Email and collaboration platforms store mailboxes wherever the tenant lives. Clinical trial systems send participant data to a sponsor’s global database.

Many of these flows were never designed as transfers. They are defaults of global software, switched on when the platform was deployed a decade earlier. The architectural task is to find them, using integration catalogs, data flow diagrams and network egress logs together, since none is complete alone. An integration catalog is a list of the connections between systems. A data flow diagram is a map of where data goes. Network egress logs record every piece of traffic leaving a network.

Where copies hide

Some of the least visible copies are in infrastructure rather than business applications. The corporate identity directory, the system that holds every employee’s account, typically replicates names, titles, managers, phone numbers and office locations to every region. Security tools copy endpoint telemetry, email messages under inspection and suspicious files to a vendor’s cloud for analysis. Ticketing systems hold screenshots and attachments that users paste in, which often include customer records.

Mobile apps are another source. A consumer app built for China customers may include software development kits, packaged pieces of third-party code for analytics, crash reporting or advertising. Many of those kits send device and usage data to servers abroad by default. The app’s owner is responsible for that flow even if no engineer on its staff wrote the code that sends it.

Discovery therefore needs several sources at once. Procurement records show which vendors serve China entities. Vendor subprocessor lists show where those vendors store and support data. Firewall, proxy and DNS logs show where traffic goes. DNS logs record the names of the services a device looks up, which reveals destinations that firewall rules summarize away. Interviews with system owners find the scheduled exports and personal workarounds that no tool sees.

Deciding what to do with each copy

Each discovered flow then needs a decision: stop it, reduce it to what is necessary, or document it under a lawful mechanism with the consent and impact assessment the law requires.

Reduction is often the cheapest of the three. A headquarters HR system may need a China employee’s grade, cost center and manager for workforce planning. It rarely needs the national identity number, home address or bank details. Trimming the synchronized fields shrinks the transfer and the impact assessment with it.

Documenting a flow carries a cost that is easy to underestimate. Separate consent must be informed and specific, naming the overseas recipient and the purpose. Consent can also be withdrawn. A flow that relies on consent must be able to stop for one person without breaking for everyone else, which few global HR integrations were built to do. Employee consent raises a further difficulty, because the power imbalance between employer and employee makes it a weak foundation in many legal systems. Companies should check with their China counsel before resting a core flow on it.

The decisions have costs. An in-country instance of a global HR system means separate upgrades, separate integrations and reporting that no longer rolls up automatically. Some vendors could not support a China instance at all in 2021, which forced replacement decisions that had nothing to do with features.

Backups and recovery

Resilience design is caught up in this too. Disaster recovery is the plan for restoring systems after a major failure, and it depends on keeping copies somewhere else. A disaster recovery copy in a regional data center outside China is a transfer like any other. Keeping recovery inside China means a second in-country site or cloud region, with its own cost and its own tests.

The recovery question also touches regulators other than the CAC. A bank’s home-country supervisor expects tested recovery for critical services. If the China recovery site is new, the first recovery test is a regulatory event in two jurisdictions. Recovery runbooks, the step-by-step procedures for restoring service, often assume that a global operations team performs the restore. If that team works from outside China, the restore itself becomes a remote-view question.

Remote views: the follow-the-sun problem

The second path is the one localization does not touch. When an analyst in New York opens a customer record stored in Shanghai, the record has been made available outside China. The CAC’s 2022 guidance on security assessments said so expressly: overseas access to, or querying of, data stored in China is a cross-border transfer.

That reaches deep into how multinationals operate. Consider follow-the-sun support, in which teams in different time zones hand work around the clock. Global service desks, centralized security operations centers reviewing logs, global finance teams reconciling accounts and vendor engineers troubleshooting production systems work the same way. All involve people outside China reading data inside it. A global security monitoring team pulling Chinese endpoint and authentication logs, which contain employee identifiers, is transferring personal information. Endpoint logs are records from laptops and phones; authentication logs record who logged in, when and from where.

Controls here are about identity and network design, not storage. Access policies need to know where a user sits as well as who they are. Common patterns include:

• Routing support for China systems to in-country teams, so the people who need to see the data are inside China.
• Masking personal fields for users outside China, replacing names or account numbers with blanks or placeholders, the way a bank statement shows only the last four digits of a card.
• Approval workflows for overseas access with a logged reason, so each exception is deliberate and recorded.
• Separate administrative accounts for China environments, so powerful global credentials do not reach China data by default.

How location-aware access works

Making access depend on location sounds simple and is not. Location can be inferred from the network a user connects through, the device’s registered office, the user’s HR record or the address of the internet connection. Each signal can be wrong. Travelers carry laptops across borders, and remote workers connect through home broadband. A policy built on one signal will both block legitimate users and admit users it should not.

A sturdier design combines signals and fails safe. The access system checks the user’s assigned location, the device and the network path. When they disagree, it shows the masked view and offers an approval route. The decision and the reason are logged. That log becomes the evidence that the control exists and works, which matters more to a regulator than the policy document.

Remote desktops do not solve the problem by themselves. Some firms tried to keep data in China by having overseas staff use a virtual desktop hosted inside the country, with downloads and copying disabled. The data never leaves the server. The person abroad still reads it on screen, so the view is still a transfer. Virtual desktops reduce the risk of copies; they do nothing for views.

Security monitoring as a special case

Security operations deserve their own treatment, because the trade-off cuts against security itself. Detection works best when one team sees every signal across the company. Splitting China out means an attacker who enters through a China office may be visible only to a smaller, less experienced local team.

There are middle paths. Logs can be processed in a China-hosted tier that strips or tokenizes personal identifiers before forwarding alerts abroad. Tokenizing means replacing an identifier with a random value that only the China tier can map back. The global team investigates the pattern; the local team resolves it to a person when needed. Incident response playbooks then need a step for requesting identity, with a named approver and a time target, so the control does not slow containment during an attack.

Vendors and their support staff

Software vendors need the same treatment: a SaaS provider whose global support staff can open customer tenants is a remote-view path, and its contract should say who may access China data and from where. The PIPL requires contracts with entrusted processors to set out the purpose, duration, method, categories of data and protection measures, and an impact assessment before entrusting. Vendors with follow-the-sun support often could not promise in-country access for every case. Contracts then needed a fallback: overseas access only on documented request, with masked views where the product allowed it.

Each control adds friction to global operating models that were built to remove it. That trade-off has to be made explicitly, function by function.

When foreign authorities ask

Remote views also include a case few architects planned for. A foreign court, regulator or law enforcement agency may demand records held in China. The PIPL and the Data Security Law both bar providing such data to foreign judicial or enforcement bodies without Chinese approval. A US bank subsidiary facing a subpoena, or a group compliance team running anti-money-laundering reviews from headquarters, can face conflicting legal duties. That conflict cannot be engineered away. It can be anticipated, with a documented escalation path and counsel in both countries engaged before a request arrives.

Derived outputs: what travels instead

The third path is the least obvious. Organizations that keep raw data in China still send things built from it. Examples include management reports listing named customers, data extracts for a global analytics team, fraud and credit models trained on transaction histories, and research datasets from clinical work. A model, in this sense, is a piece of software that has learned patterns from historical data, for example which transactions tend to be fraudulent.

The PIPL treats information that has been anonymized, so that individuals cannot be identified and the process cannot be reversed, as outside its scope. That opens a route: process locally and export only aggregated or anonymized results. Aggregated means summed or averaged across many people, such as total sales by province.

Why the route is narrower than it looks

The route is narrower than it looks. The law distinguishes anonymization from de-identification. De-identified data can no longer identify a person without additional information, and it remains personal information. Pseudonymized extracts with stable identifiers fall into that category. Pseudonymizing means replacing a name with a code, such as Customer 48213; if the same code follows the same person across files, the person can often be re-identified. Small aggregates can identify people too: an “average salary” for a team of two reveals a great deal.

Statistical agencies have long dealt with this by setting minimum cell sizes, suppressing small counts and adding controlled noise to published tables. A cell is one number in a table, such as the count of customers in one city and one age band. A company exporting China reports can adopt the same techniques. They cost something: a report with suppressed cells is less useful to the reader at headquarters, and someone has to explain why.

Models raise their own questions. A model trained on China transaction data does not contain the records in an obvious form. Research has shown that some models can leak facts about their training data, and that an attacker with access to a model can sometimes infer whether a given person was in it. Few companies in 2021 had a policy on whether a trained model is personal information. Training locally and exporting only the model, without review, rested on an assumption nobody had tested.

Anonymous is not the same as unrestricted

Anonymization takes data out of the PIPL. It does not take it out of the Data Security Law. That law created a category of important data, whose export would require a security assessment, and left sector regulators to define it through catalogs. Large aggregated datasets about a population, an industry or a region could fall into that category even with no individual identifiable. In 2021 the catalogs did not yet exist, so a fully anonymized export could still raise a question nobody could yet answer with confidence.

Life sciences firms faced a further layer, because China’s rules on human genetic resources already restricted the export of genetic material and related data. A trial sponsor also has legal duties elsewhere that pull data outward. Adverse event reports, the records of side effects in trial participants, must reach the sponsor’s global safety database and, from there, regulators in other countries. Those flows could not be stopped, so they had to be documented and minimized.

The export gate

The architecture needs a defined export gate: a place where outputs leaving China are checked against an anonymization standard, approved and logged: a single checkpoint every outbound report or dataset must pass through.

An effective gate has a few parts. A request form names the output, its recipient, its purpose and its frequency. A reviewer, usually in the local privacy or data team, checks the output against the written standard. Recurring outputs, such as a weekly report, are approved once as a template and re-checked when the template changes. Every release is logged with the approver’s name. The gate’s log, compared against egress records, shows whether anything is leaving around it.

The standard itself should be short enough for analysts to apply. It might set a minimum group size, list fields that may never leave, and say which kinds of model require review. Vague standards push every decision to the reviewer, who becomes a bottleneck, and then people route around the gate.

Mapping the three paths at a mid-sized insurer

Suppose an insurer with headquarters in the United States and a growing operation in China. Its leadership asks the obvious question first: where is our China data stored? The answer is reassuring. The core policy system has run from a Shanghai data center for years.

A small team from privacy, IT architecture and security then maps all three paths. On copies, it finds that the global HR platform synchronizes China employee records to headquarters every night. The email service stores China mailboxes in the global tenant, and backups of the Shanghai policy system are replicated to Singapore for disaster recovery. Nobody chose any of these as transfers, but all of them are.

On remote views, the global help desk in another country can open China customer records to reset accounts. The security operations center pulls China login logs into its central monitoring tool, and the policy system’s vendor has support engineers abroad with standing access.

On derived outputs, there is a weekly management report listing large China claims by customer name. There is also an extract sent to the global actuarial team, and a pricing model trained partly on China data and run at headquarters.

Decisions and owners

Each item gets a decision. The HR synchronization is cut to the minimum fields needed and documented under a lawful mechanism. Recovery copies move to a second in-country site. China help desk tickets go to an in-country team, and other users see masked fields. The vendor contract is amended to limit who can access China data and from where. The claims report becomes an aggregated version, and every outbound extract passes through an export gate.

Each decision also gets an owner. The head of HR owns the employee synchronization, and the chief information officer owns recovery and the help desk. The chief information security officer owns monitoring, the procurement lead owns the vendor amendment, and the chief actuary owns the actuarial extract and the pricing model. The privacy office owns the method and the register; it does not own the business decisions.

Sequencing

The order matters. Flows that can be stopped or trimmed cheaply go first, because every flow removed is one fewer to document. Next come the flows that need contract changes, since vendor negotiations take months. Infrastructure moves, such as a new recovery site, come last because they take longest and need testing. Documentation for the flows that remain runs in parallel, so the register is current at each stage.

Evidence

By the end, the insurer can produce a pack an examiner or internal auditor would recognize. It holds the flow register, organized by path; the impact assessments, kept for the three years the law requires; consent records where consent is relied on; vendor contract clauses; access logs showing masked views and approvals; and the export gate log. The pack is the answer to a regulator’s question and to the next audit committee’s.

The work is not glamorous, and it slows some global processes. But when regulators ask questions, the insurer can answer them, and when rules change, it knows exactly which flows are affected.

The hard part: global efficiency versus local control

The controls above are not technically difficult. What makes them hard is that each one reverses a decision a company made, years earlier, for good reasons.

Global platforms exist because they are cheaper and simpler. One HR system means one set of upgrades, one set of reports and one team to run it. A follow-the-sun help desk means customers get answers at any hour without paying for night shifts in every country. A central security operations center means a small number of skilled analysts can watch the whole company at once. Each of these is a real business benefit, and each depends on data moving freely to wherever the work is done.

Splitting China out reverses those benefits for one part of the business. An in-country HR instance must be maintained separately, and headquarters reporting has to be stitched back together. An in-country help desk may need staff in hours that were previously covered from elsewhere. A security team that can no longer pull China logs directly may need a local partner or a local analyst, and a careful arrangement for sharing only what is needed.

So the trade-offs belong with business leaders as much as with the privacy office or IT. The privacy team can say what the law requires. The architects can say what is possible. But only the people who own the operating model can choose the answer for a given function. They decide whether to localize the work, mask the data, add an approval step or accept the cost of a lawful transfer mechanism.

How the trade-off differs by business

The answer differs by type of firm. A bank’s China subsidiary usually has its own board, its own regulator and its own capital, so running it as a separate operation is already familiar. Localizing its help desk and monitoring is a moderate change. A consumer goods company that runs China through a regional shared-service center in Singapore faces a much larger change, because the efficiency of that center was the reason for building it.

A life sciences sponsor faces the hardest version. Its global science depends on pooling data across trial sites, and its safety obligations require some flows to continue. It may localize operations and still keep a documented, assessed transfer at the heart of its research model. A professional services firm with a small China office may decide the volumes are low enough to document a few flows and leave its global systems intact.

The strongest case against all this

A sceptic in 2021 could make three fair arguments. First, enforcement had targeted large domestic platforms, not the HR feeds of foreign firms, so the risk to a mid-sized multinational looked remote. Second, the implementing rules did not exist yet, so building controls risked building the wrong ones. Third, a full “China for China” split could be cheaper than fine-grained controls: build a separate stack and stop worrying about paths.

Each argument has something in it, and none settles the matter. Enforcement priorities can change faster than architecture can, and a firm that needs to change its architecture in a hurry pays far more. The implementing rules did change, but they changed the paperwork more than the definition of transfer, so a path map stayed valid. A full split removes copies, but it does not remove the views that group governance requires: board reporting, internal audit, group risk and financial consolidation all need some sight of the China business. A separate stack still has three paths; it just has fewer instances of each.

A practical way to run this is a simple grid. List each function that touches China data, from HR and finance to customer service and security monitoring. For each, record which of the three paths it uses, what control applies, who owns the decision and what it costs. The grid becomes both the compliance record and the basis for a sensible conversation about where global efficiency is worth preserving and where local control matters more.

More than one question about where the data is

The PIPL made “where is our data?” the wrong single question. The right questions are where it is stored, who can see it from where, and what is built from it and sent elsewhere.

The business stakes are concrete. Unauthorized transfers create regulatory exposure in a jurisdiction where enforcement has emphasized security as well as privacy. Fixing flows late is expensive, because it means re-architecting systems that are already in use. Global operating models, from shared service centers to central security monitoring, may need to change, which affects cost and staffing. And for regulated firms such as banks, insurers and life sciences companies, the confidence of regulators and partners depends on being able to explain data flows clearly.

A well-run program maps every flow of China personal information by path and keeps the map current. Access policies for China systems know where users are. Support and security monitoring for China environments are handled in-country where the global model cannot be justified. Vendor contracts state who may access China data and from where. A single export gate checks outbound outputs against a clear anonymization standard. Each trade-off between global efficiency and local control has been made deliberately, with a named owner.

Keeping the map current

A map drawn once decays within months. New projects add integrations, vendors add subprocessors, and teams find new ways to share reports. The register has to be wired into the processes that create change. Architecture review should ask whether a new system touches China data and by which path. Procurement should ask where a vendor will store and support it. Change management should flag new outbound connections from China networks. A quarterly comparison of the register against egress logs catches whatever slipped through.

Useful measures are simple. Count the flows in the register by path and status. Track the share of overseas access to China systems that came through the masked or approved route. Track how long export gate requests take, because a slow gate breeds workarounds. Report findings from the egress comparison: flows found that the register did not know about. A falling number there is the clearest sign the program works.

Where programs fall short, it is mostly by stopping too early:

• Treating localization as the finish line. Moving storage while copies, views and outputs keep flowing.
• Trusting a single source to find flows. Catalogs, diagrams and logs each miss things.
• Forgetting backups and recovery. A disaster recovery copy abroad is still a transfer.
• Overlooking vendors. A provider’s global support staff are a remote-view path.
• Assuming pseudonymized means anonymous. Stable codes and small groups can still identify people.
• Ignoring infrastructure. Identity directories, security tools and app components copy personal data without appearing in any business process map.
• Relying on consent that cannot be withdrawn cleanly. A consent-based flow that cannot stop for one person is not really consent-based.

How the PIPL applies to a particular company’s operations is a question for its lawyers in China.

Every China data flow needs a mapped path and an approver

• Do we have a map of every flow of China personal information, organized by copies, remote views and derived outputs? Who keeps it current?
• Who outside China can view China data today, including our help desk, security operations and vendors? How do we know?
• What reports, extracts and models built from China data leave the country, and who approves them?
• What standard do we use to decide that an output is truly anonymized?
• If a regulator asked tomorrow how China personal information leaves the country, could we answer in a day?

Each of those questions has an owner in the grid described above. A program that can name the owner for each, and show the log that proves the answer, has done the work the law asked for.

With hindsight

The PIPL’s transfer regime has since been filled in and then partly relaxed. Measures for security assessments of outbound data were published in July 2022 and took effect that September. The standard contract measures followed in February 2023 and took effect in June 2023, with a requirement to file signed contracts and impact assessments with the provincial internet regulator. Certification took longest. Technical specifications appeared in 2022, and formal certification measures from the CAC and the market regulator were issued in October 2025 and took effect on January 1, 2026. The mechanisms the law described in outline gained detailed procedures.

The remote access reading held

The CAC’s application guide for security assessments, issued in August 2022, settled the question this article turns on. It listed overseas organizations or individuals being able to query, retrieve, download or export data stored in China as a form of outbound transfer. Firms that had treated localization as the finish line had to reopen their programs.

Enforcement in the first year also showed where the regulator’s attention lay. In July 2022, the CAC fined Didi RMB 8.026 billion for violations of the Cybersecurity Law, the Data Security Law and the PIPL, after the review opened in July 2021. Revised cybersecurity review measures took effect in February 2022, requiring platforms holding the personal information of more than a million users to seek review before listing abroad. Both cases were about domestic platforms and national security, which supported the sceptics’ view that ordinary multinational HR feeds were not the target. Neither changed what counted as a transfer.

Then the relief

In March 2024, the CAC issued provisions that exempted several kinds of transfer from the formal mechanisms. They included transfers necessary for cross-border human resources management and for performing contracts with individuals. The provisions also raised the volume thresholds that trigger a security assessment. Non-sensitive personal information of fewer than 100,000 people a year, counted from January 1, no longer needed a mechanism at all, for processors that were not critical infrastructure operators. Security assessment was kept for transfers of more than a million people’s information, or sensitive information of more than 10,000. The validity of an approved assessment was extended from two years to three.

Free trade zones have since published their own lists of data that can leave more easily. Tianjin issued the first negative list in May 2024, Beijing followed that summer, and Shanghai’s Lingang area published lists of general data for specific cross-border scenarios.

Then the tightening elsewhere

The relief on transfers came alongside heavier obligations in other places. The State Council’s network data security regulations took effect on January 1, 2025. CAC measures on personal information compliance audits took effect in May 2025. Amendments to the Cybersecurity Law, adopted in October 2025 and in force from January 1, 2026, raised its maximum fines sharply. The regime grew lighter at the border and heavier inside it.

What held up and what did not

The relaxation reduced paperwork but did not change what counts as a transfer, so remote access by teams outside China still needs a lawful basis and controls. A global help desk opening a China record is still making data available abroad, even if the formal process for doing so has become lighter.

Enforcement has emphasized data security and national security as much as individual privacy. For multinationals, that means data flows from China are read through more than one lens, and a privacy-only view of the problem is incomplete.

Some of the 2021 caution looks excessive now. Firms that rebuilt their entire HR stack in China to avoid an employee-data transfer found in 2024 that cross-border HR management had been exempted. The exemption covers what is necessary, though, and firms still had to show that the fields they sent were needed.

Organizations that mapped copies, views and outputs were able to use the exemptions quickly, because they already knew which flows qualified. Those that had only moved storage had to start the mapping when the relief arrived, and so waited longer to benefit from it.

A clear inventory of data flows pays off in both directions. When rules tighten, it shows what must change. When rules loosen, it shows what can be simplified. In a regulatory environment that has moved in both directions within a few years, that adaptability is worth as much as any single compliance decision.