Moving your China employees' data into a global HR system or up to an overseas parent is, under China's Personal Information Protection Law (PIPL), a cross-border data transfer — and it raises two separate questions, not one. First, do you have a lawful basis to process the data? For genuine HR administration you usually do, without asking each employee. Second, what do you need to lawfully export it? That is a different test: a transfer mechanism where the thresholds bite, a specific notice to staff, and a personal-information protection impact assessment (PIPIA). The mistake foreign employers make is assuming the HR basis answers both.
- PIPL treats sending employee data abroad — even to your own parent or a shared group HRIS — as a cross-border transfer, governed by its own rules on top of your basis to process.
- HR management under lawfully adopted labour rules or a collective contract is a lawful processing basis under PIPL Article 13(2) — no separate employee consent needed to handle the data.
- The March 2024 CAC Provisions exempt genuinely HR-necessary transfers from all three export routes — security assessment, standard contract, certification — with no volume cap.
- The exemption removes the mechanism, not the rest: you still owe a specific export notice under Article 39 and a PIPIA under Articles 55–56, kept on file for at least three years.
- The basis is narrow. Data pushed abroad for anything beyond genuine HR necessity — group analytics, marketing, non-HR reporting — falls outside, and the thresholds and consent rules reappear.
One export, two legal questions
PIPL keeps two things apart that foreign HR teams tend to merge. Processing is whether you may collect and use the data at all; cross-border transfer is whether you may send it out of China. Article 13 lists the lawful bases for processing, and item (2) expressly allows handling personal information where it is necessary for human-resources management carried out under labour rules and regulations formulated in accordance with law, or under a collective contract lawfully concluded. That basis lets you run payroll, benefits, org charts and performance records without collecting individual consent.
But Article 38 is what governs the export, and it offers three routes: a CAC security assessment, the CAC standard contract (China's SCCs) with a filing, or certification from an accredited body. Which one applies turns on volume, sensitivity and your role — the mechanics are set out in our companion note on the three PIPL cross-border transfer routes. Having a processing basis does not, by itself, satisfy Article 38. If you are still standing up your China entity and its people function, sequence this alongside the rest of hiring employees as a foreign employer, not after the HRIS is already live.
What the March 2024 rules changed for HR data
On 22 March 2024 the Cyberspace Administration of China (CAC) issued the Provisions on Promoting and Regulating Cross-Border Data Flows, which took immediate effect and materially eased the regime. For HR specifically, the Provisions created a dedicated exemption: where the transfer of employee personal information is necessary to carry out cross-border human-resources management in accordance with lawfully adopted internal labour rules and a collective contract, you do not need a security assessment, a standard contract or certification.
Crucially, this HR exemption carries no volume threshold. It applies even where the number of employees exceeds the one-million or 100,000 headcounts that would otherwise force a mechanism — provided the data actually moving stays within what is genuinely necessary for HR management. For a multinational consolidating global payroll or a group-wide HRIS, that is a significant simplification. But read it strictly: it is an exemption from the export mechanism, and only for HR-necessary data.
What you still owe employees
The exemption is narrower than it looks because the rest of PIPL still applies. Two obligations are non-negotiable for any HR export:
- A specific export notice (Article 39). Before you transfer, employees must be told the overseas recipient's name and contact details, the purpose and method of the overseas handling, the categories of personal information involved, and how to exercise their PIPL rights against that recipient. A generic privacy policy is not enough — the notice must speak to the export itself.
- A PIPIA (Articles 55–56). A cross-border transfer is one of the situations for which PIPL mandates a personal-information protection impact assessment in advance. It must assess the lawfulness and necessity of the processing, the risks to employees, and whether your protective measures are adequate. The report and processing records must be retained for at least three years.
On consent, the position is more nuanced than most global playbooks assume. PIPL's separate consent requirement for exports attaches when your processing basis is consent. Where you instead rely on the HR-management basis under Article 13(2), separate consent to the transfer is generally not required for genuinely HR-necessary data — but the Article 39 notice and the PIPIA still are. Given that enforcement practice continues to develop, some employers take a belt-and-braces approach and obtain consent anyway; the defensible minimum, however, is accurate notice plus a documented PIPIA. Sending data beyond HR necessity is where consent — and a mechanism — come back.
When the HR basis runs out
Two boundaries catch foreign groups out. The first is purpose: the HR basis covers what is necessary to manage the employment relationship. Feed the same records into a global CRM, a marketing platform, product analytics or non-HR group reporting, and that slice of data leaves the exemption — you then need consent and, above the thresholds, a mechanism. The second is data type. Employee files routinely contain sensitive personal information — passport and ID numbers, bank and financial details, biometrics, health and, in some cases, background-check results — which carries lower thresholds and heightened obligations.
For any flow that falls outside the HR exemption, the standard thresholds govern (measured cumulatively per calendar year, for a non-CIIO handling no important data):
- Under 100,000 individuals (non-sensitive): generally no mechanism required.
- 100,000 to 1 million (non-sensitive), or fewer than 10,000 sensitive: standard contract with filing, or certification.
- Over 1 million (non-sensitive), or 10,000+ sensitive: CAC security assessment.
- Critical information infrastructure operators, or any transfer of important data: security assessment, regardless of headcount.
Getting this wrong is not a paperwork risk. PIPL's penalty ceiling for serious violations reaches RMB 50 million or 5% of the prior year's turnover, with possible suspension of operations — reason enough to treat the analysis as a board-level compliance item, part of your wider corporate compliance and data posture.
A practical stack for HR data export
Work the problem in this order, and document each step:
- Map the data. List exactly which employee fields leave China, to which recipient, for what purpose — separating HR-necessary flows from everything else.
- Classify and pick the route. Confirm whether each flow sits inside the HR exemption; for the rest, apply the volume and sensitivity thresholds above to choose a mechanism.
- Run the PIPIA. Required regardless of the exemption; complete it before the transfer starts.
- Give specific notice. Issue the Article 39 export notice to employees, and obtain consent for any processing beyond HR necessity.
- Execute the mechanism. Sign and file the standard contract, obtain certification, or clear the security assessment as the thresholds require.
- Keep records. Retain the PIPIA and processing records for at least three years, and re-run the assessment when systems, recipients or data categories change.
Frequently asked questions
Usually yes for genuine HR administration. PIPL Article 13(2) allows processing that is necessary for human-resources management under lawfully adopted labour rules or a collective contract, so consent is not the basis. You still owe a specific export notice and a PIPIA, and consent returns for any use beyond HR necessity.
No. The March 2024 CAC Provisions exempt genuinely HR-necessary transfers from all three export routes, with no volume cap. The exemption removes only the mechanism — the rest of PIPL, including notice and the impact assessment, continues to apply.
Yes. A cross-border transfer is a mandatory trigger for a personal-information protection impact assessment under PIPL Articles 55–56, even when the transfer mechanism is exempted. Complete it before transferring and keep the report for at least three years.
Only the parts that are truly necessary for HR management. Data routed to non-HR uses such as group analytics, marketing or product platforms falls outside the exemption, and the volume thresholds and consent rules apply to that slice.
For flows outside the HR exemption and per calendar year: 100,000 to 1 million individuals of non-sensitive data, or fewer than 10,000 sensitive, point to a standard contract or certification; over 1 million, or 10,000 or more sensitive, requires a CAC security assessment. Critical information infrastructure operators and any important-data transfer require a security assessment regardless.
Sources
- Littler — China's New Cross-Border Data Transfer Rules Substantially Reduce Compliance Burdens for Multinational Employers (March 2024 CAC Provisions; HR-management exemption from the standard contract, and the remaining notice and impact-assessment obligations).
- Greenberg Traurig — China Relaxes Requirements for Cross-Border Data Transfers (exemptions and the 100,000 / 1 million / 10,000-sensitive thresholds, and that PIPIA obligations survive an exemption).
- PIPL cross-border data transfer: the three legal routes — our companion guide to the security assessment, standard contract and certification mechanisms.
This article is general information for foreign companies, not legal advice on any specific matter. Rules and practice change; please take advice on your facts.