If mainland headquarters, engineers, support or HR can retrieve or view EU/EEA personal data, include that access in the GDPR Chapter V map even where the server remains in Europe. Hosting-region labels are not the test. Determine exporter and importer roles. Select adequacy, the correct EU SCC module, BCRs or another lawful mechanism. Complete annexes that match the live purposes, run a transfer impact assessment, and adopt supplementary measures that address the identified destination risk. Article 49 derogations are not a standing architecture. An EU SCC does not satisfy a PRC outbound mechanism. A PRC SCC does not satisfy Chapter V. Related: GDPR for Chinese companies (DPO / representative) and PIPL vs GDPR.
One task: Map a Chapter V transfer when mainland staff can see EU personal data — do not use a PRC SCC as the answer. · Pillar:China cross-border data-transfer decision guide · Legally reviewed on 8 August 2026 · Law and official guidance checked through 15 August 2026. Editorial orientation — not a determination.
Use potential, possible, may require. Never “compliant”, “approved” or “definitely exempt”.
Direct answer
Track B tree
Can a person or system in mainland China retrieve or view the EU personal data?
Who is exporter (usually the EEA controller/processor granting access) and who is importer?
Is there an adequacy decision for that importer situation? (Do not invent one.)
If SCCs: which module (C-to-C, C-to-P, P-to-P, P-to-C) matches the roles?
Do the annexes name the real purposes, categories, recipients, retention and access paths?
TIA: destination legal/practical environment for this dataset and access path.
Supplementary measures that actually reduce the identified risk (access control, encryption/key location, minimisation) — not a logo pack.
Onward transfers from the China importer.
Separately open Track A if mainland PI also leaves China. Two files.
TIA anatomy (editorial)
Transfer description · parties · destination laws relevant to this access · practical access by public authorities · existing contractual and technical measures · gap · supplementary measures · residual risk · review date. EDPB 01/2020 is guidance, not a statute — do not draw it as equal to Chapter V.
General information only. Confirm the instrument version that applies to your facts.
Source register · primary authorities and verification
Sources & trust
How to use this guide
Primary sources for this page (editorial source-check 2026-09-19): PRC Personal Information Protection Law (PIPL). Prefer the current official Chinese text of each instrument over secondary commentary. Confirm current rules with qualified counsel. This page is not legal advice.
Editorial, AI and verification policies
This page is general information for orientation. It is not legal advice and does not create an attorney–client relationship.
Legal boundary: Prefer primary statutes, judicial interpretations, and official guidance when making decisions. Where this guide links to city hubs or lawyer listings, verify credentials and engagement terms directly with counsel. Full disclaimer · Submit an initial enquiry.
FAQ
Common questions
Quick answers for foreign nationals and employers. Rules vary by city and change over time.
Our vendor is “EU-only hosting.” Are we done?
No, if China-based identities can still open the tenant.
We already filed a China SCC for HR.
That file does not complete Chapter V for EU employee or customer data viewed from China.
Consultation preparation
Before contacting counsel
First package for a conflict check
A concise timeline and the result you want to achieve.
Names of all parties and affiliates for a conflict check.
Key contracts, notices, correspondence, filings, or decisions.
Known deadlines, preferred language, location, and budget constraints.
Topic counsel
Counsel shortlist for this guide
Profiles matched by practice to this topic. A shortlist for consultation — not an endorsement of any filing, clearance or legal outcome.
Practice-matchedVerified status shown per profileFree initial consultation
Use International Lawyers for host-country counsel. Use Find Counsel when a PRC workstream (ODI, SAFE, onshore entities, mainland contracts) still sits beside the destination matter.
Status shown per profileFree initial intakeDestination + PRC routing
