Intra-Group Data Sharing (I): Cross-Border Compliance for Employee Personal Information

Global HR platforms allow multinational companies to coordinate payroll, performance reviews, employee mobility and benefits across jurisdictions. For China subsidiaries, these arrangements often involve providing employee personal information to overseas headquarters, regional teams or shared service centres.

Chinese law permits qualifying cross-border HR transfers to benefit from a procedural exemption. Its availability depends on the purpose and necessity of the particular activity. Companies should therefore assess what headquarters needs, why it needs it, and which protections must accompany the sharing.

When does headquarters access constitute a data export?

Uploading employee records to an overseas server or sending them to overseas headquarters ordinarily constitutes a data export. Overseas personnel accessing employee information from abroad may also trigger the export rules, even where the information remains stored on a server in mainland China.

The relevant consideration is where access or retrieval occurs. Personnel of an overseas organisation accessing China-stored information while physically in mainland China, without transmitting it abroad, do not conduct a data export solely because of their overseas affiliation.

Companies should map both storage and access arrangements. Global HR systems may expose information to several group entities and service providers, each performing different functions.

When is the HR exemption available?

Article 5 of the Provisions on Promoting and Regulating Cross-Border Data Flows exempts qualifying transfers necessary for cross-border HR management from the CAC security assessment, personal information export standard contract and personal information protection certification mechanisms.

The activity must be conducted in accordance with lawfully formulated employment rules and lawfully concluded collective contracts, and the employee information must genuinely need to be provided overseas. Important data falls outside this exemption.

The China subsidiary should be able to explain why the overseas recipient needs the employee information to perform its specific HR functions. Payroll administration, performance approval or international assignments may support such an explanation, depending on the actual arrangements. A general reference to “group management” provides insufficient justification for unrestricted access to employee files.

Necessity should be assessed at three levels: the transfer itself, the employees included, and the information fields disclosed. For example, headquarters reviewing total workforce costs may only need aggregated reports. An overseas team administering payments may need particular account details, without requiring access to unrelated health or family records.

Global employment policies should also be reviewed against the subsidiary’s Chinese employment arrangements. Broad sharing clauses cannot substitute for a purpose-specific assessment.

What obligations remain?

Qualifying HR transfers are exempt from the security assessment, standard contract and certification requirements. Companies must still provide the required employee notices, conduct a personal information protection impact assessment (“PIPIA”) and implement appropriate safeguards.

Under Article 13 of the Personal Information Protection Law (“PIPL”), qualifying HR processing may rely on a legal basis other than consent. Where the overseas provision itself falls within the non-consent grounds in Article 13(1)(2)–(7), consent is not required, but export notice obligations remain.

Article 39 requires employees to be informed of the overseas recipient’s name and contact details, processing purposes and methods, information categories, and the methods and procedures for exercising their rights against that recipient. Where consent is required, it should be specific and separate; a blanket authorisation in onboarding documents is insufficient.

Articles 55 and 56 require a prior PIPIA, with the assessment report and processing records retained for at least three years. Article 38 also requires necessary measures to ensure that the overseas recipient’s processing meets PIPL protection standards.

To implement these requirements, companies should limit access according to each recipient’s role and processing purpose, set appropriate retention periods, restrict further disclosure, and define responsibilities for responding to data security incidents and employee rights requests. Sensitive personal information, such as health records and financial account information, requires stricter safeguards. Such processing must have a specific purpose and sufficient necessity. Employees must also be informed of the necessity of processing sensitive personal information and its impact on their rights and interests.

Recruitment data and activities outside the HR exemption

Applicant information should be assessed separately from existing employee records. Where overseas headquarters does not participate in hiring decisions, exporting applicant CVs lacks the necessary connection to recruitment. Where it directly participates, the disclosure should be limited to the applicants and information needed for that decision, with the applicable export requirements assessed separately. The CAC’s July 2026 guidance specifically calls for notice, separate consent and a PIPIA in this recruitment scenario; companies should not assume that the employee HR exemption automatically covers applicants.

Activities outside the HR exemption may qualify for another exemption (e.g., qualifying low-volume transfers of non-sensitive personal information by a non-critical information infrastructure operator). Otherwise, companies must determine whether a standard contract, certification or security assessment is required, considering their status, information categories and cumulative export volumes. The calculation should cover the exporter’s relevant activities as a whole, rather than an individual HR system. For the annual thresholds, count the individuals concerned from 1 January of the current year, excluding qualifying HR-exempt transfers and other transfers excluded under the applicable rules.

Small employee numbers alone do not establish an exemption: the processing purpose, applicable information categories and other countable exports can affect the result. Sensitive employee information can still fall within a qualifying HR exemption; it is not covered by the separate low-volume exemption for non-sensitive personal information.

A six-step internal compliance workflow

Multinational companies can establish a clear internal process for assessing employee data transfers.

Create an employee personal information inventory. Classify names, contact details, identity documents, remuneration, bank account details, performance evaluations, attendance records and health information, and identify sensitive personal information.
Map the data flows. Identify whether employee information is transferred to overseas servers, headquarters, affiliated companies or third-party service providers. Record the actual recipients, storage locations and any access from abroad.
Assess the cross-border HR management exemption. Review the lawfully formulated employment rules and lawfully concluded collective contracts, the processing purposes and the necessity of providing the information overseas.
Calculate the relevant export volumes. Distinguish non-sensitive from sensitive personal information and count the individuals concerned from 1 January of the current year, excluding qualifying exempt transfers as required by the applicable rules. Assess the applicable thresholds across the exporter’s relevant activities, together with its status and whether important data is involved.
Complete the applicable compliance procedures. Where no exemption applies, determine the required export mechanism: a security assessment, standard contract or personal information protection certification. A mandatory security assessment cannot be replaced by either of the other two mechanisms. Fulfil notice, separate consent where legally required, PIPIA and other applicable obligations, including those that continue to apply to exempt transfers.
Maintain ongoing oversight. A signed contract or completed filing does not establish permanent compliance. Reassess the arrangement when material changes occur in the data categories, export volumes, processing purposes, overseas recipients or system architecture, and complete any required reassessment, filing, certification update or other procedure before implementing the change.

A workable compliance framework links overseas HR responsibilities to defined information needs. The China subsidiary and headquarters should document that connection, implement it through notices and system permissions, and revisit it when purposes, recipients or access arrangements change.

Our team advises foreign-invested companies on employee data transfers between their China operations and overseas headquarters. We assess the availability of the HR exemption, review employee notices and internal policies, conduct personal information protection impact assessments, and prepare intra-group data sharing agreements. Where required, we also assist with standard contract filings, certification and security assessment applications.