How it works in practice
Most FIEs start with a data map and a transfer-impact assessment, then test whether a security assessment is mandatory or whether an SCC filing or certification is available. Group cloud architectures, shared HRIS, and global CRM instances frequently need redesign or localization options. Treat marketing claims that “GDPR is enough” as incomplete for China.
FAQ
Is every SaaS tool a “cross-border transfer”?
If personal information leaves the mainland (including to Hong Kong/Macao/Taiwan in many analyses, and to overseas SaaS regions), treat it as a potential transfer until counsel and the data map say otherwise.
Do intra-group transfers need a path?
Yes. Affiliates abroad are still overseas recipients. Parent-company access to China employee or customer data is a classic compliance trigger.
Where should I start?
Start with the CBDT roadmap and export path tool, then engage data counsel for filing strategy.