Buyer Guides · 7 MIN
China PIPL and cross-border data: what software projects must plan for
How PIPL cross-border transfer rules affect software projects: scope, the three transfer routes, the 2024 thresholds, remote access and architecture choices for Chinese companies going global.
Under China's Personal Information Protection Law (PIPL), a company that sends personal information collected in China to an overseas party, including a software vendor, must use one of three routes: a CAC security assessment, a filed standard contract, or certification. Since March 2024, small volumes are exempt. Which route applies depends on how many people's data you move and whether it is sensitive.
- PIPL Article 38 gives three main routes for exporting personal information: a CAC security assessment, a standard contract filed with the regulator, or certification.
- Article 39 requires telling individuals about the overseas recipient and obtaining their separate consent.
- The CAC's March 2024 provisions exempt small, non-sensitive transfers and set thresholds for the other two routes.
- The cheapest compliance step is often architectural: keep China data in China and give overseas engineers masked or synthetic data.
- Data about people outside China, held in your systems, mostly falls under other countries' laws such as GDPR rather than PIPL exports.
- Nactore is an AI-native technology and growth company in Mumbai that can build with masked data, regional hosting and access logs so fewer records cross borders.
This guide is written for Chinese companies expanding to the US, UK and EU, so it follows the data in both directions. Official Chinese texts are published in Chinese by the Cyberspace Administration of China (CAC), for example the 2024 cross-border data provisions. The English links below are unofficial translations by third parties and may lag the current text. Always confirm with PRC counsel.
Does PIPL apply to your software project?
PIPL applies to the processing of personal information of natural persons within China (Article 3). It also reaches processing outside China when the purpose is to provide products or services to people in China, to analyze their behavior, or in other cases set by law. Outside processors in those cases must set up a dedicated entity or appoint a representative in China (Article 53). An English translation is available from DigiChina at Stanford, which is unofficial.
For a software project, ask one question first. Does the system hold personal information about people in China, such as employees, customers or app users? If yes, giving an overseas developer access to it is an export question. If the system only holds data about people in the US or EU, GDPR and US state laws matter more than PIPL.
What are the three routes for exporting data?
Article 38 sets the conditions. The common ones are these.
| Route | What it is | Typical use |
|---|---|---|
| CAC security assessment | The regulator reviews the transfer | Very large volumes, sensitive data, critical information infrastructure operators |
| Standard contract | A CAC model contract between you and the overseas recipient, filed with the provincial regulator | Mid-sized transfers |
| Certification | A professional body certifies the processing | Some group and multinational cases |
Article 39 adds notice and consent. Before sending data abroad, you must tell the individual the recipient's name and contact details, the purpose and method of processing, the types of data, and how to exercise their rights with the recipient, and you must obtain their separate consent. Article 55 requires a personal information protection impact assessment in advance when providing personal information abroad. Article 40 requires operators of critical information infrastructure, and processors above CAC volume thresholds, to store personal information collected in China within China.
What changed in March 2024?
The CAC's Provisions on Promoting and Regulating Cross-Border Data Flows, took effect on publication on 22 March 2024 and loosened the regime. The Chinese original is on the CAC site, and the China Law Translate version is unofficial. Several law-firm summaries, including those from Hankun Law, describe the same volume tiers, counted cumulatively from 1 January of the current year. The tiers below apply to processors that are not critical information infrastructure operators.
| Annual volume of personal information exported | Requirement |
|---|---|
| Fewer than 100,000 individuals, no sensitive data | No assessment, standard contract or certification |
| 100,000 to 1 million individuals, or sensitive data of fewer than 10,000 individuals | Standard contract filing or certification |
| 1 million or more individuals, or sensitive data of 10,000 or more individuals | CAC security assessment |
The provisions also exempt several cases, including data transfers necessary to perform a contract with the individual (such as cross-border shopping or payments) and cross-border HR management under lawful policies. Data generated outside China that is transferred into China and back out, without being mixed with domestic personal information, is also exempt. Pilot free trade zones may publish negative lists, and data outside a zone's list can be exempt from the three routes. Check the current lists with counsel, because these are the areas most likely to shift.
Does remote access from India count as a transfer?
Treat it as one. Practitioners commonly read "provision outside China" to include overseas parties viewing or accessing data stored in China, even when the data does not physically move. So an India-based team debugging a live database in Shanghai is inside the question. This is a reading to confirm with counsel for your case.
How do you design around the rules?
Many teams cut their compliance load by changing the architecture, not by filing more paperwork.
- Keep China data in China. Host users' personal information in a mainland region, and keep the overseas service stack separate.
- Use masked or synthetic data in development, staging and testing, so overseas engineers never see real records.
- Send aggregates, not records. Dashboards and models can often run on de-identified or summarized data. Note that "anonymized" in PIPL means irreversibly so, which is a high bar.
- Log and limit access. If a break-glass access route is needed, name the people, time-limit it and record every session.
- Document the decision. Keep the impact assessment, the contract and the data flow map.
What about the other direction, Western user data going into China?
When a Chinese company serves EU users and stores their data in China, GDPR Chapter V applies. China is not on the European Commission's list of adequacy decisions, so you need Standard Contractual Clauses and an assessment of local law. UK GDPR works similarly. The simplest fix is to host that data in an EU or UK region. The GDPR DPA checklist for hiring developers shows the contract terms. For the wider expansion plan, see Chinese companies going global: how to choose a tech partner.
Draw one diagram before you hire anyone overseas. Mark where each type of personal information is stored, who can see it and from which country. Counsel will ask for exactly that.
Frequently asked questions
Do we need a CAC filing to give an overseas developer access to test data?
Not if the data contains no real personal information. Use masked or synthetic data in test environments and keep the evidence.
Which route applies if we export data on 50,000 users a year?
Under the 2024 provisions, fewer than 100,000 non-sensitive records a year is exempt from the three routes, but PIPL's other duties, such as notice, consent and security, still apply. Confirm with counsel.
Are English translations of PIPL official?
No. The ones linked here are unofficial. The Chinese text published by the authorities controls.
Is this legal advice?
No. It is a plain-language overview. Confirm with PRC counsel before acting.
A short close
PIPL rewards teams that decide early where personal information lives and who can reach it. Settle that before the first engineer is onboarded.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.