If mainland headquarters, engineers, support or HR can retrieve or view EU/EEA personal data, include that access in the GDPR Chapter V map even where the server remains in Europe. Hosting-region labels are not the test. Determine exporter and importer roles. Select adequacy, the correct EU SCC module, BCRs or another lawful mechanism. Complete annexes that match the live purposes, run a transfer impact assessment, and adopt supplementary measures that address the identified destination risk. Article 49 derogations are not a standing architecture. An EU SCC does not satisfy a PRC outbound mechanism. A PRC SCC does not satisfy Chapter V. Related: GDPR for Chinese companies (DPO / representative) and PIPL vs GDPR.
One task: Map a Chapter V transfer when mainland staff can see EU personal data — do not use a PRC SCC as the answer. · Pillar:China cross-border data-transfer decision guide · Legally reviewed on 8 August 2026 · Law and official guidance checked through 15 August 2026. Editorial orientation — not a determination.
Use potential, possible, may require. Never “compliant”, “approved” or “definitely exempt”.
Direct answer
Track B tree
Can a person or system in mainland China retrieve or view the EU personal data?
Who is exporter (usually the EEA controller/processor granting access) and who is importer?
Is there an adequacy decision for that importer situation? (Do not invent one.)
If SCCs: which module (C-to-C, C-to-P, P-to-P, P-to-C) matches the roles?
Do the annexes name the real purposes, categories, recipients, retention and access paths?
TIA: destination legal/practical environment for this dataset and access path.
Supplementary measures that actually reduce the identified risk (access control, encryption/key location, minimisation) — not a logo pack.
Onward transfers from the China importer.
Separately open Track A if mainland PI also leaves China. Two files.
TIA anatomy (editorial)
Transfer description · parties · destination laws relevant to this access · practical access by public authorities · existing contractual and technical measures · gap · supplementary measures · residual risk · review date. EDPB 01/2020 is guidance, not a statute — do not draw it as equal to Chapter V.
Legal boundary: Prefer primary statutes, judicial interpretations, and official guidance when making decisions. Where this guide links to city hubs or lawyer listings, verify credentials and engagement terms directly with counsel. Full disclaimer · Request a consultation.
FAQ
Common questions
Quick answers for foreign nationals and employers. Rules vary by city and change over time.
Our vendor is “EU-only hosting.” Are we done?
No, if China-based identities can still open the tenant.
We already filed a China SCC for HR.
That file does not complete Chapter V for EU employee or customer data viewed from China.
Consultation preparation
What to prepare before contacting counsel
Send a focused first package so counsel can check conflicts, understand scope, and identify urgent deadlines.
A concise timeline and the result you want to achieve.
Names of all parties and affiliates for a conflict check.
Key contracts, notices, correspondence, filings, or decisions.
Known deadlines, preferred language, location, and budget constraints.
Topic counsel
Lawyers relevant to this topic
Review profiles matched to this guide, then request a free initial consultation.
Status shown per profileFree initial consultationTopic-matched shortlist
Use International Lawyers for host-country counsel. Use Find Counsel when a PRC workstream (ODI, SAFE, onshore entities, mainland contracts) still sits beside the destination matter.
Status shown per profileFree initial consultationDestination + PRC routing
