Data flagship · CBDT roadmap · Path tree · SCC timeline · PIPL vs GDPR · First hire · Employment flagship.
Employee tick-box consent rarely takes HR data out of China by itself. If names, pay, ID numbers, passports or performance sit on a server or vendor outside the PRC, map the flow, run an impact assessment, minimise fields, then pick a live CAC path: standard contract, certification, or security assessment. Thresholds and “important data” tests are versioned — confirm the instruments in force the week you file; do not use a 2022 blog’s headcount. Localise what you can. Write purpose, recipients and retention into both the PIPL file and the labour paperwork. A works council is usually not a veto; notice and personnel-file rules still apply. Dismissal files sent to HQ are the same export, not a loophole.
At a glance
| Question | Short answer |
|---|---|
| Is HQ HRIS an export? | Usually yes if the system or admin is outside the PRC. |
| Is consent enough? | Almost never alone. |
| Which path? | SCC / certification / assessment — confirm live CAC rules. |
| ID / biometrics? | Treat as sensitive PI unless counsel says otherwise. |
| Union veto? | Usually not. Still inform and document. |
| Full three-path essay? | CBDT roadmap + path-tree pages. |
Scope and legal framework
PIPL (outbound / separate consent / sensitive PI). Providing personal information abroad is a regulated act. Separate consent appears in the statute but is not a substitute for a transfer mechanism. Sensitive PI (ID numbers, biometrics, specific identity, medical, etc.) needs a stricter necessity story.
CAC outbound measures (assessment / SCC / certification). Three families exist. Which one you need depends on volume, role (CII), important data and the current implementing rules. Quote the gazette in force — not a memorised headcount from an old webinar.
Labour Contract Law / personnel-file practice. Exporting the file does not erase China labour duties: notice, access, retention. Works-council consultation is not usually a legal block on a PIPL transfer, but skipping employee notice is a separate failure.
Practical workflow
- List every HR field that leaves China (including vendor admins abroad).
- Drop what HQ does not need; keep ID/biometric out of the default sync.
- Run the impact assessment and pick the live CAC path.
- Sign SCC or complete assessment/certification; align the employment privacy notice.
- Control access, retention and leaver off-boarding on both sides.
- For the form-filling, use the SCC timeline page.
Common mistakes
- “Employees clicked I agree.”
- Turning on the global Workday connector for every China field.
- Emailing the disciplinary file to US employment counsel with no path.
- Using a 2022 headcount trigger as if it were still the rule.
Action checklist
- System diagram: where is the HRIS?
- Field list with sensitivity tags.
- Legal path chosen against current CAC text.
- Notices updated; SCC/assessment filed if required.
- Leaver + access SOP on both sides.
Find data and employment counsel
The data-privacy listings below are live DJ Classifieds profiles. Labour notice issues may also need employment counsel.
