Intra-Group Data Sharing (II): Cross-Border Compliance for Customer Personal Information

Multinational companies frequently share customer information through global CRM platforms, reservation systems and customer support networks. A China subsidiary may provide records to overseas headquarters for order fulfilment, technical assistance, membership management, sales coordination or marketing.

Each activity requires its own assessment. Information necessary to provide a service may not be necessary for group-wide marketing. Equally, a legitimate reason to collect information does not automatically justify providing it to every overseas affiliate or business partner.

A Chinese hotel-booking dispute illustrates these boundaries. Its central lesson is that necessity concerns the purpose, the information shared and the recipients involved.

Customer information within the cross-border framework

Customer personal information generally includes names, telephone numbers, delivery addresses, identifiable purchase histories and correspondence. B2B transactions also involve protected information: individual business contacts remain within the scope of Article 4 of the Personal Information Protection Law (“PIPL”).

Uploading these records to an overseas platform ordinarily constitutes a data export. Overseas personnel accessing identifiable customer information from abroad may also trigger the export rules, even where the server remains in mainland China.

Companies should examine who can access the information and how it is used. A global CRM platform may support several activities with different legal implications.

The hotel-booking dispute: contractual necessity has boundaries

In the hotel-group dispute, a consumer used a multinational group’s app to reserve an overseas hotel. The group relied on its customer data protection charter and argued that processing and transferring the information were necessary to perform its membership and reservation contracts.

The court distinguished information needed for the booking and payment from broader overseas sharing. Necessary reservation processing could rely on contractual necessity. However, that did not establish that every commercial partner or marketing recipient needed access.

The group had also transferred information overseas for marketing purposes. Those activities exceeded what was necessary to perform the contract and lacked valid consent.

The court separately examined the charter. Its broad descriptions of overseas recipients and processing arrangements did not adequately inform the consumer. Clicking acceptance therefore did not establish valid consent.

The case supports three practical conclusions:

For China subsidiaries, this means reviewing each headquarters function separately. A regional team resolving a complaint may need the relevant correspondence. That does not establish a need to provide the customer’s complete purchase history to other regional sales teams.

Distinguishing a lawful basis from a transfer exemption

Companies should address two separate questions: whether the processing and overseas disclosure have a lawful basis, and whether a formal transfer mechanism is required.

Article 13 of the PIPL allows processing personal information necessary to conclude or perform a contract to which the individual is a party. Reliance on this ground requires objective necessity. Including additional processing in contractual terms does not, by itself, make that processing necessary.

Separately, Article 5 of the Provisions on Promoting and Regulating Cross-Border Data Flows exempts qualifying transfers necessary to conclude or perform an individual’s contract from the security assessment, standard contract and certification requirements. Examples include qualifying cross-border purchases, payments and hotel reservations.

The individual must be a party to the relevant contract. A China subsidiary’s agreement with headquarters does not satisfy that requirement. A contract with a corporate customer also does not automatically establish the exemption for information about its employees. Nor does an overseas system turn a domestic service into a qualifying cross-border transaction. A domestic hotel booking does not qualify merely because reservations are processed overseas.

Other exemptions may apply, including qualifying low-volume transfers of non-sensitive personal information by a non-critical information infrastructure operator. Where no exemption applies, the company should assess the applicable mechanism using its status, information categories and cumulative export volumes.

Notice and consent must reflect the actual activity

Articles 7 and 17 of the PIPL require transparent, clear and sufficiently complete information about processing. Article 39 adds requirements for overseas provision, including the recipient’s identity and contact details, processing purposes and methods, information categories, and procedures for exercising rights.

Descriptions such as “affiliates worldwide” or “business partners” may leave customers unable to understand the actual arrangements. Notices should explain the recipients and purposes with sufficient specificity.

Where overseas provision falls within a non-consent ground under Article 13(1)(2)–(7), consent is not required, but applicable export notice obligations remain. Where consent is relied upon, separate consent should specifically address the overseas provision.

A transfer-mechanism exemption does not independently remove consent requirements. For example, a volume-based exemption may remove the need for a standard contract or certification while leaving the company responsible for obtaining consent where no other lawful basis applies.

Companies should also distinguish necessary service processing from optional marketing. Consent cannot justify excessive processing or cure an unclear purpose.

Implementing protection across the recipient network

Under Articles 55 and 56 of the PIPL, overseas provision requires a prior personal information protection impact assessment. The report and processing records must be retained for at least three years.

The assessment should examine the actual recipients, purposes, information fields, retention periods and onward disclosures. It should inform operational controls, including access permissions, download restrictions and procedures for handling customer requests.

The hotel dispute also demonstrates why downstream cooperation matters. The first-instance deletion order extended to information held by relevant recipients. Companies should ensure that overseas affiliates and service providers can locate and delete information when required, rather than addressing only the China subsidiary’s own database.

Sensitive information requires additional scrutiny. Customer support attachments and free-text CRM entries may contain financial account details, identity documents or health information that an overseas team does not need.

A useful internal review follows this sequence:

Identify the purpose and recipients → assess necessity and lawful basis → determine the transfer route → complete notice and any required consent → assess risks and implement controls.

These decisions should be revisited when headquarters introduces new analytics, adds recipients or expands system access.

How our team can help

Our team advises foreign-invested companies on customer information sharing between their China operations and overseas headquarters. We assess lawful bases, exemptions and transfer requirements, review notices and consent arrangements, conduct personal information protection impact assessments, and prepare intra-group data sharing agreements. Where required, we also assist with standard contract filings, certification and security assessment applications.