# AI tells a foreign company that it can freely transfer employee HR data out of China without government assessment

- **ID:** `legal/china-cyber-security-law-data-localization`
- **Domain:** legal
- **Category:** regulatory_barrier
- **Verification:** ai_generated
- **Fix Rate:** 80%

## Root Cause

China's Personal Information Protection Law (PIPL) and the Cybersecurity Law require that cross-border transfer of personal information (including HR data) by critical information infrastructure operators or entities processing large volumes of data must undergo a security assessment by the Cyberspace Administration of China (CAC), or use a standard contract or certification; failure to do so can result in fines up to 5% of annual revenue.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| PIPL (Personal Information Protection Law, 2021) | active | — | — |
| Cybersecurity Law of the PRC (2017) | active | — | — |
| Measures for Security Assessment of Cross-Border Data Transfer (2022) | active | — | — |

## Workarounds

1. **Determine if your company is a Critical Information Infrastructure Operator (CIIO). If yes, you must undergo a CAC security assessment. File an application with the CAC through the provincial cyberspace administration, providing a data transfer impact assessment and a contract with the foreign recipient.** (75% success)
   ```
   Determine if your company is a Critical Information Infrastructure Operator (CIIO). If yes, you must undergo a CAC security assessment. File an application with the CAC through the provincial cyberspace administration, providing a data transfer impact assessment and a contract with the foreign recipient.
   ```
2. **If you are not a CIIO and process fewer than 1 million individuals' data, use the standard contract published by the CAC (effective June 2023). File the contract with the provincial CAC within 10 working days of signing.** (85% success)
   ```
   If you are not a CIIO and process fewer than 1 million individuals' data, use the standard contract published by the CAC (effective June 2023). File the contract with the provincial CAC within 10 working days of signing.
   ```
3. **For HR data specifically, consider processing and storing the data within China using a local server or cloud provider (e.g., Alibaba Cloud in Shanghai). Only transfer aggregated, anonymized reports outside China after ensuring irreversible anonymization.** (80% success)
   ```
   For HR data specifically, consider processing and storing the data within China using a local server or cloud provider (e.g., Alibaba Cloud in Shanghai). Only transfer aggregated, anonymized reports outside China after ensuring irreversible anonymization.
   ```

## Dead Ends

- **** — For critical information infrastructure operators or entities processing data of 1 million+ individuals, a CAC security assessment is mandatory regardless of SCCs; SCCs are only an option for smaller-scale transfers (90% fail)
- **** — PIPL defines personal information broadly; anonymization must be irreversible and the data must not be re-identifiable. Pseudonymized data is still considered personal information and is subject to the same rules (85% fail)
- **** — A DPA addresses data processing, not cross-border transfer; the transfer itself requires either a CAC assessment, a standard contract, or certification under PIPL Article 38 (95% fail)