Data Export from China: Three Routes, Thresholds and Timelines for Multinationals

An export is a transfer of access, not of location

Multinationals tend to think of data export as copying a file across a border. The regulatory definition is wider. Data collected and generated in China that is accessed from outside China — viewed, queried, downloaded, or processed by an overseas team — has been exported, even if the data never leaves the Chinese server.

This matters because the arrangements that most easily escape notice are exactly the ones that constitute exports: a global HR platform, a shared analytics dashboard, remote support by an overseas engineer, and a group-wide CRM.

Three routes and their thresholds

Two features of the table are frequently misread. The routes are alternatives for the same volume band, not a sequence; and the exemption removes the filing, not the obligation to inform individuals and to establish a lawful basis.

Counting rules that decide the route

The thresholds are cumulative and annual. Counting starts from 1 January, aggregates all transfers to all recipients, and separates sensitive from non-sensitive personal information.

For a group, the counting entity matters. Where several Chinese entities each act as an independent processor, each counts its own transfers. Where one entity processes on behalf of the group, its cumulative volume governs — which can push a group across a threshold that no single business unit would reach alone.

Employee data counts. HR platforms, global payroll and performance systems routinely move employee personal information abroad, and that volume is included in the same calculation.

Timelines

Preparation, not review, is the long pole.

Standard contract filing is reviewed within ten working days of acceptance. Preparing the contract, the personal information protection impact assessment and the internal mapping typically takes four to eight weeks for a mid-sized group.

Security assessment runs in months. Three to six months from preparation to result is a reasonable planning assumption, and the process cannot be accelerated by adding resources.

Certification sits between the two, and depends on the accredited institution’s schedule.

Whichever route applies, the sequencing constraint is the same: the assessment or filing must precede the transfer, not follow it. Groups that begin after the system goes live are choosing between delaying the rollout and accepting an unlawful transfer.

The governance that keeps it current

A single filing is a snapshot. What keeps a group compliant is a small, maintained set of documents:

1. A data map. Which systems hold Chinese personal information, which are accessed from abroad, and by whom.
2. A counting record. Cumulative volumes by category and recipient, updated quarterly, so the applicable route can be identified before it changes.
3. Contracts and assessments for each recipient, with the clauses that support the route.
4. A review trigger list. Recipient changes, purpose changes, new systems, and legal developments in the destination country.

Where groups commonly fail

Counting only customer data. Employee and vendor data are usually the larger volume and the least examined.

Treating remote access as internal. Access from outside the border is an export regardless of who is looking.

Assuming the exemption is permanent. Volumes grow; a transfer exempt in January may cross a threshold by December.

Filing after launch. The most expensive error, because it converts a scheduling problem into a compliance one.

Relying on consent. Consent does not replace an assessment where one is required.

The work is unglamorous and mostly administrative. Its value is that it can be shown — to a regulator, an acquirer, or a group audit — rather than described.

Related reading: Data Export: Choosing Among Three Routes, Personal Information Protection Impact Assessment, AI Vendor DPA Review.