How to Protect Data in China

In September 2024, the Cyberspace Administration of China (CAC) fined a foreign-owned cloud services firm for storing the personal data of Chinese users on servers located outside mainland China. The penalty reached millions of yuan, and the company’s domestic subsidiary was required to migrate its data onto local infrastructure within a set timeframe. For a Western IT leader, that enforcement action changes the entire market-entry discussion: where your data physically resides is the main control point Chinese regulators use to determine compliance, not just a technical detail.

It applies to any company processing the data of Chinese residents, regardless of whether the company has a physical presence in China. This means a Western company handling Chinese customer data on AWS servers in Oregon is considered non-compliant by regulators even before any breach occurs.

China’s Cross-Border Data Rules in 2026

China’s data regulations rely on three main laws, each with specific requirements. The PIPL (个人信息保护法) regulates how personal information is collected, stored, and transferred. The Data Security Law (DSL, 数据安全法) categorizes data by importance and enforces national-security controls on “important data” and “core data.” The Cybersecurity Law (CSL, 网络安全法), effective since 2017, requires critical information infrastructure operators to store data locally and complete security assessments before transferring data across borders. For more details on these evolving rules, see our 2026 China data compliance guide.

The PIPL outlines several ways to export personal information: passing a CAC security assessment, obtaining certification from an authorized body, or signing a standard contract filed with the regulator. The most significant update for foreign companies came in 2024, when the CAC lowered the threshold for its security assessment, exempting smaller-volume transfers and moving many companies to the simpler standard-contract option. This change reduced compliance burdens for mid-size exporters but did not eliminate the expectation to localize data.

If your product stores Chinese customer data, you should plan to host it domestically. The CAC’s enforcement actions consistently treat the physical location of servers as the main compliance factor.

The Digital Infrastructure Stack

China’s internet operates behind the Great Firewall, which blocks or slows most Western consumer services by default. Google Workspace, Slack, Dropbox, and even basic Gmail are unreliable without workarounds. This is a structural aspect of the market and requires a specific architecture choice: either run a fully domestic stack or maintain a hybrid setup that connects both environments.

The domestic cloud market is led by three main providers. Alibaba Cloud (阿里云) has the largest market share and the widest international reach, with data centers outside mainland China for companies needing cross-border redundancy. Tencent Cloud (腾讯云) focuses on gaming, social media, and WeChat-related workloads. Huawei Cloud (华为云) specializes in government and state-enterprise contracts and promotes itself as “sovereign” infrastructure. Each provider requires a Chinese business license and a domestic entity or local reseller to contract directly.

For communication, WeChat (微信) is the standard for both internal and external messaging, replacing Slack and email in most Chinese business settings. Alipay (支付宝) and WeChat Pay dominate payments; Stripe does not have a significant presence for domestic Chinese transactions. Western teams typically use a bridge approach: a domestic instance of a compliant collaboration tool for the China team, synced to the global stack through an approved data-transfer method. Our guide to Alipay and WeChat Pay explains how to set up these payment systems for business use.

File Sharing and Cloud Storage Across the Divide

This area presents practical challenges for most readers. Standard Western file-sharing tools do not work well in mainland China for two reasons: they are blocked by the Firewall, and even when accessed via VPN, they store Chinese personal data offshore, violating the PIPL. This creates a two-tier market.

Domestic options include Weiyun (微云), Tencent’s cloud drive, and Baidu Netdisk (百度网盘), the consumer leader with hundreds of millions of users. Both perform well inside China but do not provide a straightforward way for Western teams to share data with global headquarters. Enterprise tools like Seafile and Nextcloud, when self-hosted on domestic cloud instances, give IT teams full control over data location, meeting localization requirements while maintaining a connection to global systems.

The trade-off is clear. A fully domestic tool ensures compliance and speed but fragments your collaboration stack and creates a separate source of truth. A Western tool accessed through a corporate VPN works technically but is formally non-compliant and increasingly risky as enforcement tightens. The common solution is self-hosting a tool inside China that syncs encrypted metadata abroad, though this requires significant engineering effort.

A Practical Compliance Checklist

For Western companies entering China or expanding their presence, the following steps cover the main obligations. Use this as a starting point, not a replacement for local legal advice, since enforcement practices and provincial interpretations can vary.

• Data mapping. Identify all categories of personal data collected from Chinese users and classify them according to the DSL’s importance levels. You cannot create a compliant transfer plan without this knowledge.
• Entity setup. Establish a Chinese legal entity (外商独资企业, a wholly foreign-owned enterprise) or work through a licensed reseller. Direct cloud and hosting contracts usually require this.
• Localization. Transfer Chinese personal data and any “important data” onto domestic infrastructure. This step is the largest cost factor and the most common compliance hurdle.
• Transfer mechanism. Select your PIPL cross-border transfer method: CAC security assessment, certification, or standard contract. After the 2024 threshold change, most mid-size firms qualify for the standard contract.
• Consent and notice. Update privacy notices to clearly disclose cross-border transfers, obtaining separate consent where necessary. PIPL consent requirements are more detailed than GDPR’s lawful-basis model.
• Incident response. Develop a breach-notification process that meets the CAC’s reporting deadlines, which can be stricter than the GDPR’s 72-hour window.

An often overlooked expense is the ongoing audit requirement. The DSL mandates periodic security assessments for certain data types, and the CAC has conducted on-site inspections of foreign firms’ domestic operations. Plan for a continuous compliance function rather than a one-time project.

Cost Comparison: Domestic vs. Cross-Border Tools

Costs vary significantly by volume and vendor, and pricing pages change frequently. The table below provides indicative figures in both currencies where pricing is stable and links to vendor pages where it is not. Always verify current pricing before making commitments.

The payment fees for Alipay and WeChat Pay vary by merchant category and negotiated volume, so the figure above is an approximate benchmark rather than a fixed rate. Cross-border data egress often surprises finance teams because transferring data from China to global regions incurs per-gigabyte fees and may require a transfer assessment under the PIPL.

China should be treated as a separate operating region with its own data residency, identity, and payment systems, not as an extension of your existing global infrastructure. Companies that add China onto a Western architecture without planning face duplicated costs in rework and compliance risks. Successful firms maintain a dedicated domestic footprint, connect it to headquarters through approved channels, and staff compliance as an ongoing expense.

Key Takeaways:

• The PIPL imposes fines up to 50 million yuan or 5% of annual revenue and applies to any company processing Chinese residents’ data, regardless of physical presence.
• The CAC focuses on server location as the main compliance factor: domestic hosting of Chinese personal data is the standard expectation.
• Three transfer methods exist under the PIPL (security assessment, certification, or standard contract), and the 2024 threshold change moved most mid-size firms to the standard-contract option.
• Domestic tools (Baidu Netdisk, Weiyun, WeChat Work, Alipay) ensure compliance and speed but fragment the global stack; self-hosted Seafile or Nextcloud on domestic infrastructure is the common bridging solution.
• Treat China as a separate operating region with its own residency, identity, and payment systems, and plan for a continuous compliance function rather than a one-time project.

Related Reading

More in-depth coverage from this blog on closely related topics:

• China Business Culture Tips
• How to Use Alipay and WeChat Pay for Business