Overseas expansion creates a data operation before it creates a transfer document. A Chinese group should first map who collects customer and employee data, which entity decides the purpose, which systems and vendors process it, who can access it from mainland China, and which incident and rights teams are responsible. Only then can it select contracts and transfer mechanisms.
1. Draw the operation, not just the group chart
Create one record for each sales, HR, support, analytics and vendor workflow. Identify the data subjects, categories, purposes, systems, locations, recipients, retention and every local or remote access path. Group ownership does not by itself decide whether an EU subsidiary, mainland parent or vendor is controller, joint controller or processor.
2. Establish the local processing basis
For the EU/EEA example, document purpose, lawful basis, necessity, transparency, minimisation, retention, rights handling and any DPIA before reuse or export. Marketing consent, employment necessity and legitimate interests are not interchangeable labels. A new purpose needs its own compatibility and notice analysis.
3. Contract the vendor chain
Processor terms should state documented instructions, confidentiality, security, sub-processor control, assistance with rights and incidents, audit information, and deletion or return. Map onward transfers and operational access rather than relying on a vendor's hosting-region label.
4. Treat China-based access as a transfer question
If mainland headquarters, engineers, support or HR personnel can retrieve or view EU personal data, include that access in the Chapter V map even where the server remains in Europe. Determine the exporter/importer roles and whether adequacy, SCCs, binding corporate rules or another lawful mechanism fits. Do not use Article 49 derogations as a routine architecture.
5. Complete the SCC and TIA work
Select the correct SCC module, complete the annexes with the actual purposes, data, recipients, retention and security, assess the destination legal/practical environment, and adopt supplementary measures that are effective for the identified risk. A signed template without the map and assessment is not a complete transfer programme.
6. Run the mainland PRC interface separately
Test each China-return or onward path under PIPL and current CAC rules. Determine whether a security assessment, standard contract or certification route applies, whether a current exemption is available, and what notice, separate consent, personal-information protection impact assessment, important-data and security duties remain. Do not assume an EU SCC satisfies PRC requirements or vice versa.
7. Build security and incident ownership
Assign controls to the actual access path: authentication, least privilege, logging, encryption/key control, export/download restrictions, vendor assurance, retention deletion and tested recovery. An incident playbook should preserve facts, contain access and open separate EU/EEA and PRC notification assessments immediately.
8. Operate a change gate
Reopen the record before a new country, product purpose, data category, system, vendor, sub-processor, China access team or material legal change. Review high-risk transfers monthly and the full map at least annually.
Decision record
The accountable owner should sign a record naming the roles, lawful bases, notices, vendor terms, transfer mechanism, TIA/PIPIA, PRC route or exemption, security measures, residual risks, incident contacts and next review date. For a live operation, counsel must resolve the source-pack reviewer questions. This framework is not approval of a transfer or filing strategy.
Selected official sources
General information only, not legal advice. Laws, guidance and operational facts can change. Obtain advice for the relevant jurisdictions and current facts.