China Cross-Border Data Transfer Roadmap
If a person outside China can access China personal information or regulated data, treat it as a transfer project until the current rules and architecture show otherwise. Map first, then select the mechanism.
Workflow guide
Consent is not a transfer mechanism, and read-only overseas access can still be a transfer.
Inventory systems, recipients and remote access; classify personal, sensitive and potentially important data; select the pathway under the CAC instruments in force; complete the assessment and documentation; and reopen the analysis when vendors, purposes or systems change.
Run the project from map to change control.
Thresholds, catalogues and free-trade-zone rules are versioned; use current official materials.
Include employee, customer, clinical, device and vendor-admin access. A system remaining in China does not end the inquiry if an overseas user can view the data.
Do not use an old headcount threshold or GDPR contract as the current China answer. Confirm the live CAC instrument and the actual architecture before selecting the route.
Complete the transfer map.
Selections remain in this browser.
Common architecture questions.
The answer depends on the current rules and system facts.
Does overseas read-only access count as a transfer?
If a user outside China can access the information, plan it as a transfer until current advice on the specific architecture establishes otherwise.
What is the applicable headcount threshold?
Thresholds have changed. Use the CAC rule in force for the relevant period and do not hard-code an older webinar number into the project.
Source station
Use current CAC materials and the specialist filing guides.
Open the route that owns the next decision.
Path selection precedes the mechanism-specific filing.
China Data Compliance Guide
Use for the wider PIPL and cybersecurity framework.
Open specialist route →02 · Filing routeChina SCC Filing Workflow
Use after selecting the standard-contract path.
Open specialist route →03 · HR routeEmployee Data Transfers
Use for HRIS and workforce access.
Open specialist route →Escalate when classification or pathway is uncertain.
Important data, sector rules, volumes and hidden access require current analysis.
Important data may be presentA security-assessment or sector route may apply.
Overseas access is hiddenSupport, administration or reporting is absent from the first map.
A system is about to launchThe transfer route must be resolved before production access.
Educational information only — not legal advice. Laws, rates, deadlines and local practice can change; obtain current fact-specific advice.
Topic counsel
Counsel shortlist for this guide
Profiles matched by practice to this topic. A shortlist for consultation — not an endorsement of any filing, clearance or legal outcome.
Practice-matchedVerified status shown per profileFree initial consultation
Joyce Huang
VerifiedJiushang Law Firm · Beijing · Languages: Mandarin, English
Tongyu Yan
Shanghai AllBright Law Offices · Pudong · Languages: English, Mandarin
Ruiqing Long
Beijing Zhong Lun Law Firm · Chaoyang · Languages: English, Mandarin
Wen Lei
Beijing Jingshi Law Firm · Haidian · Languages: English, Mandarin