Data stayed in China and still left: PIPL’s remote access problem

The week

On August 20, 2021, the Standing Committee of China’s National People’s Congress adopted the Personal Information Protection Law (PIPL), which took effect on November 1, 2021. It was China’s first comprehensive personal information law and followed the Data Security Law, in force from September 1, 2021. The PIPL set legal bases for processing, rights for individuals, stricter rules for sensitive personal information such as financial accounts, medical and health data and biometrics, and obligations for some organizations outside China that process the information of people in China. Personal information could leave China only through a security assessment by the Cyberspace Administration of China (CAC), certification, or a standard contract, and transfers generally required separate consent and an impact assessment. Operators of critical information infrastructure, and processors above volume thresholds the regulator would set, had to store personal information collected in China within China.

Many multinationals first read the PIPL as China’s version of the GDPR, and the comparison holds for definitions, legal bases and individual rights. Its practical weight, though, fell on cross-border transfer. For banks with China operations, insurers, and life sciences companies running trials or research there, the first instinct was to localize: stand up in-country instances of HR, customer and research systems, and keep the data in Chinese data centers or cloud regions.

That was necessary for many and sufficient for few. A transfer under the PIPL is not only a file crossing a border. Regulators made clear that making personal information available to people or systems outside China counts too. An organization with every database in Shanghai can still be transferring data many times a day. Personal information leaves through three distinct paths, and each needs its own architectural control: copies, where systems replicate data abroad; remote views, where people outside China read data that stays inside; and derived outputs, where reports, extracts and models built from the data travel instead of the data itself.

Copies: replication nobody designed

The most visible path is replication. Global HR platforms synchronize employee records to a headquarters instance. Customer relationship tools mirror account data to a global tenant. Backups are written to a regional data center in Singapore. Email and collaboration platforms store mailboxes wherever the tenant lives. Clinical trial systems send participant data to a sponsor’s global database.

Many of these flows were never designed as transfers. They are defaults of global software, switched on when the platform was deployed a decade earlier. The architectural task is to find them, using integration catalogs, data flow diagrams and network egress logs together, since none is complete alone. Each discovered flow then needs a decision: stop it, reduce it to what is necessary, or document it under a lawful mechanism with the consent and impact assessment the law requires.

The decisions have costs. An in-country instance of a global HR system means separate upgrades, separate integrations and reporting that no longer rolls up automatically. Some vendors could not support a China instance at all in 2021, which forced replacement decisions that had nothing to do with features.

Resilience design is caught up in this too. A disaster recovery copy in a regional data center outside China is a transfer like any other. Keeping recovery inside China means a second in-country site or cloud region, with its own cost and its own tests.

Remote views: the follow-the-sun problem

The second path is the one localization does not touch. When an analyst in New York opens a customer record stored in Shanghai, the record has been made available outside China. The CAC’s 2022 guidance on security assessments said so expressly: overseas access to, or querying of, data stored in China is a cross-border transfer.

That reaches deep into how multinationals operate. Global service desks, follow-the-sun support, centralized security operations centers reviewing logs, global finance teams reconciling accounts, and vendor engineers troubleshooting production systems all involve people outside China reading data inside it. A global security monitoring team pulling Chinese endpoint and authentication logs, which contain employee identifiers, is transferring personal information.

Controls here are about identity and network design, not storage. Access policies need to know where a user sits, not only who they are. Common patterns include routing support for China systems to in-country teams, masking personal fields for users outside China, approval workflows for overseas access with a logged reason, and separate administrative accounts for China environments. Software vendors need the same treatment: a SaaS provider whose global support staff can open customer tenants is a remote-view path, and its contract should say who may access China data and from where. Each adds friction to global operating models that were built to remove it. That trade-off has to be made explicitly, function by function.

Derived outputs: what travels instead

The third path is the least obvious. Organizations that keep raw data in China still send things built from it: management reports listing named customers, data extracts for a global analytics team, fraud and credit models trained on transaction histories, and research datasets from clinical work.

The PIPL treats information that has been anonymized, so that individuals cannot be identified and the process cannot be reversed, as outside its scope. That opens a route: process locally and export only aggregated or anonymized results. The route is narrower than it looks. Pseudonymized extracts with stable identifiers remain personal information. Small aggregates can identify people. Life sciences firms faced a further layer, because China’s rules on human genetic resources already restricted the export of genetic material and related data. The architecture needs a defined export gate: a place where outputs leaving China are checked against an anonymization standard, approved and logged.

The three paths explain why localization projects often ended in surprise. Storage moved, but copies, views and outputs kept flowing. Organizations that mapped all three, system by system and team by team, could answer a regulator’s questions and adjust when rules changed. Organizations should check with local counsel on how the rules apply to their own operations.

With hindsight

From 2026, the PIPL’s transfer regime has been filled in and then partly relaxed. Measures for security assessments of outbound data took effect in September 2022, and the standard contract measures in June 2023. In March 2024, the CAC issued provisions that exempted several kinds of transfer from the formal mechanisms, including those necessary for cross-border human resources management and for performing contracts with individuals, and raised the volume thresholds that trigger a security assessment. Free trade zones have since published their own lists of data that can leave more easily. The relaxation reduced paperwork but did not change what counts as a transfer, so remote access by teams outside China still needs a lawful basis and controls. Enforcement has emphasized data security and national security as much as individual privacy. Organizations that mapped copies, views and outputs were able to use the exemptions quickly, because they already knew which flows qualified.