This page anchors the MNC China data (HR/CRM) cluster to the statute stack so US/EU headquarters can map product architecture to real legal paths—not generic “GDPR in China” slogans.
Practice-area sequence. The sections below are specific to this guide.
1MapPersonal & important data flows
2BasisPIPL notices, consents, contracts
3TransferAssessment, SCC or certification
4OperateVendors, incidents, audits
General information only. PIPL, data-export security assessment, standard contract, and certification paths depend on volume, sensitivity, industry, and CAC/local practice. This is not legal advice and does not create an attorney–client relationship. Instruct qualified PRC privacy counsel before you connect global HRIS/CRM instances or ship employee files offshore.
Legal boundary: Prefer primary statutes, judicial interpretations, and official guidance when making decisions. Where this guide links to city hubs or lawyer listings, verify credentials and engagement terms directly with counsel. Full disclaimer · Submit an initial enquiry.
FAQ
Common questions
Quick answers for foreign nationals and employers. Rules vary by city and change over time.
Is SCC always enough for global Workday/SAP?
Not always. Volume thresholds, important data, CII, and sector rules can force security assessment or localisation. Run the decision tree spoke.
Does GDPR adequacy replace PIPL export rules?
No. China outbound transfer rules are independent of EU adequacy narratives.
Topic counsel
Counsel shortlist for this guide
Profiles matched by practice to this topic. A shortlist for consultation — not an endorsement of any filing, clearance or legal outcome.
Practice-matchedVerified status shown per profileFree initial consultation
