Localisation is triggered by role and data type — it is not a blanket PRC cloud ban.
Some data must be stored in Mainland China, with export only through a gated path. Classic triggers: CII operators’ personal information and important data; important data identified by catalogue; and sector rules (autos, finance, health, mapping, and others). PIPL also requires local storage for CII and handlers processing PI above a CAC-specified volume, with export via assessment. Ordinary commercial PI is often exportable via SCC/assessment/certification rather than banned. Hong Kong is not Mainland storage. This page does not reprint sector circular numbers that move.
4 questions before you choose the route.
This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.
Are you CII or volume-triggered?
CSL/PIPL local-storage clauses.
TriggerIs it important data?
Open the important-data page.
ImportantIs there a sector overlay?
Auto, finance, health, maps.
SectorIf stored in China, can it still leave?
Usually via a CBDT path, not a silent sync.
ExportWorking rule: Map the regulated role before marketing or launch in China.
The signal ledger.
These facts move the question beyond a label and into a product, money-flow and control analysis.
Bring a compact evidence docket—not a pitch deck.
Give a compliance team or counsel the operating facts that reveal the perimeter.
Questions people ask before they build.
Short answers for orientation. The right result can change with the service model and current rules.
Must employee email stay in China?
Not by a blanket rule. CII/volume/sector facts can still pull mail and HR systems onshore.
Is a CDN an export?
If PI is provided to overseas nodes, treat it as in-scope until you prove otherwise.
Primary authorities
Reviewed sources support orientation, not a fact-specific assessment.