Skip to main content
National Practice Guide · L3

MNC China Data Compliance: Key Laws

This page anchors the MNC China data (HR/CRM) cluster to the statute stack so US/EU headquarters can map product architecture to real legal paths—not generic “GDPR in China” slogans.

Updated13 Aug 2026
AudienceForeign businesses & individuals
Author China Law List Editorial · Last reviewed · 2 min read · Editorial policy · AI content policy · Disclaimer · Not legal advice — confirm current rules with counsel and authorities

At a glance

Practice: typical process stages

Four high-level stages — details and local variations are in the guide below.

  1. FrameMap facts to PRC rules
  2. PlanOptions, risks & timeline
  3. ExecuteFilings, contracts, forums
  4. ReviewCompliance & next steps
City hubs

Local guides & lawyers

Drill into city × practice hubs where available, or open the city legal market guide.

General information only. PIPL, data-export security assessment, standard contract, and certification paths depend on volume, sensitivity, industry, and CAC/local practice. This is not legal advice and does not create an attorney–client relationship. Instruct qualified PRC privacy counsel before you connect global HRIS/CRM instances or ship employee files offshore.

MNC China data compliance cluster: Hub · PIPL checklist (US cos) · Employee data outbound · HR / CRM systems · Export path decision · Sensitive localization · SCC filing · Primary sources · Checklist

Core instruments

  • Personal Information Protection Law (PIPL)
  • Data Security Law (DSL) and Cybersecurity Law (CSL) — important data / CII themes
  • Cross-border data transfer mechanisms — security assessment, standard contract (SCC), certification (as available)
  • Sector rules — automotive, health, finance overlays where applicable
  • Employer labour interfaces — employee notice/consent and handbook practice

Related deep guides on this site

Need counsel on China data export for HR/CRM?

Browse Cross-Border Data Transfer lawyers or Ask a Lawyer with your system architecture diagram and approximate PI volume.

Sources & trust

How to use this guide

This page is general information for orientation. It is not legal advice and does not create an attorney–client relationship. For methodology and AI-assisted drafting rules, see our Editorial Policy and AI Content Policy. Directory badge meaning is described in the Lawyer Verification Policy.

Prefer primary statutes, judicial interpretations, and official guidance when making decisions. Where this guide links to city hubs or lawyer listings, verify credentials and engagement terms directly with counsel. Full disclaimer · Request a consultation.

FAQ

Common questions

Quick answers for foreign nationals and employers. Rules vary by city and change over time.

Is SCC always enough for global Workday/SAP?

Not always. Volume thresholds, important data, CII, and sector rules can force security assessment or localisation. Run the decision tree spoke.

Does GDPR adequacy replace PIPL export rules?

No. China outbound transfer rules are independent of EU adequacy narratives.

Directory

Verified Practice lawyers

China-based listings shown first. Browse lawyer profiles for practice, then request legal help.

Verified listingsconsultationChina-first directory sort

Browse practice directory →

Need counsel on practice?

Connect with listed lawyers to request legal help. No obligation.