Delta Law Expat Services Desk ｜ Personal Information Protection Law of the People's Republic of China（《中华人民共和国个人信息保护法》）, in force from 2021-11-01, read with the Provisions on Promoting and Regulating Cross-Border Data Flows（《促进和规范数据跨境流动规定》）, Order No. 16 of the Cyberspace Administration of China, in force from 2024-03-22.
- Sending a foreign employee's personal information from a Chinese entity to its overseas head office is a cross-border provision of personal information under Chinese law. The employee's own nationality makes no difference.
- Three separate layers apply and are routinely collapsed into one: the lawful basis for processing (article 13), the transfer route (article 38), and the notification and separate consent required for the transfer itself (article 39).
- Article 5 of Order No. 16 exempts cross-border human resources management from all three transfer routes. Article 10 of the same Order keeps the notification, separate consent and impact assessment obligations in place. The exemption is from the route, not from consent.
- The filing thresholds changed in 2024. Article 13 of Order No. 16 provides that where Order No. 11 of 2022 is inconsistent with it, Order No. 16 applies — so the widely quoted 100,000-person assessment threshold is no longer the assessment threshold.
- A cross-border transfer always triggers a personal information protection impact assessment under article 55(4), with records kept for at least three years under article 56.
1. The documents at a glance
| Item | Content |
|---|---|
| Full title | Personal Information Protection Law of the People's Republic of China（《中华人民共和国个人信息保护法》）; Provisions on Promoting and Regulating Cross-Border Data Flows（《促进和规范数据跨境流动规定》）; Measures for the Security Assessment of Data Exports（《数据出境安全评估办法》） |
| Document number | Order No. 16 and Order No. 11 of the Cyberspace Administration of China（国家互联网信息办公室令第16号、第11号） |
| Adopted / promulgated | Law adopted 2021-08-20; Order No. 16 adopted 2023-11-28 and promulgated 2024-03-22; Order No. 11 promulgated 2022-07-07 |
| Current version in force from | Law from 2021-11-01; Order No. 16 from 2024-03-22 (date of promulgation); Order No. 11 from 2022-09-01 |
| Issuing authority | Standing Committee of the National People's Congress; Cyberspace Administration of China |
| Official text | http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html and https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm and https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm |
| What this page covers | The three layers that govern a routine transfer of employee data to an overseas parent, and which of them the human resources exemption actually removes. |
2. Why this catches your foreign employees too
Article 3, paragraph 1 of the Personal Information Protection Law applies the Law to the processing of the personal information of natural persons within China. It says nothing about the nationality of the person whose information is processed, and article 4, paragraph 1 defines personal information as information relating to an identified or identifiable natural person recorded electronically or otherwise, excluding anonymised information. A German engineer working for a Shanghai subsidiary is a natural person whose personal information is processed in China, and the Law applies to that processing exactly as it applies to a Chinese colleague's.
The second half of the misconception is the more expensive one. Sending that engineer's payroll, appraisal or leave data back to the group's head office in Germany is not repatriation of the employee's own information; it is a provision of personal information outside China by the Chinese processor, and it engages articles 38 and 39. A number of groups apply their cross-border controls carefully to Chinese staff data and treat foreign staff data as somehow outside the regime. Nothing in the Law supports that distinction.
3. Layer one: the lawful basis for processing
第十三条 符合下列情形之一的，个人信息处理者方可处理个人信息：（一）取得个人的同意；（二）为订立、履行个人作为一方当事人的合同所必需，或者按照依法制定的劳动规章制度和依法签订的集体合同实施人力资源管理所必需；……
依照本法其他有关规定，处理个人信息应当取得个人同意，但是有前款第二项至第七项规定情形的，不需取得个人同意。
Article 13, paragraph 1: A personal information processor may process personal information only where one of the following applies: (1) the individual's consent has been obtained; (2) it is necessary for the conclusion or performance of a contract to which the individual is a party, or necessary for the implementation of human resources management in accordance with employment rules and regulations formulated in accordance with law and a collective contract concluded in accordance with law; … Paragraph 2: Where under other relevant provisions of this Law the processing of personal information requires the individual's consent, consent is not required where any of items (2) to (7) of the preceding paragraph applies.
Unofficial translation; the Chinese text as officially published prevails.
Item (2) contains two limbs, and the second is the one that matters for an employer: human resources management carried out under employment rules and regulations formulated in accordance with law and a collective contract concluded in accordance with law. Both conditions are written into the provision. An employer relying on this limb is asserting that its rules and regulations were formulated in accordance with law — which is a question about how those rules were adopted, not merely about what they say.
Paragraph 2 then does something narrower than it first appears. It removes the requirement of consent where items (2) to (7) apply. It does not remove the notification obligations elsewhere in the Law, and it does not by its terms reach the separate consent required by article 39 for a transfer out of China. That is the distinction the rest of this page turns on.
4. Layer two: the transfer route, and the thresholds that changed
第三十八条 个人信息处理者因业务等需要，确需向中华人民共和国境外提供个人信息的，应当具备下列条件之一：（一）依照本法第四十条的规定通过国家网信部门组织的安全评估；（二）按照国家网信部门的规定经专业机构进行个人信息保护认证；（三）按照国家网信部门制定的标准合同与境外接收方订立合同，约定双方的权利和义务；（四）法律、行政法规或者国家网信部门规定的其他条件。
个人信息处理者应当采取必要措施，保障境外接收方处理个人信息的活动达到本法规定的个人信息保护标准。
Article 38, paragraph 1: Where a personal information processor genuinely needs to provide personal information outside China for business or other reasons, it shall meet one of the following conditions: (1) passing a security assessment organised by the national cyberspace administration authority under article 40 of this Law; (2) obtaining personal information protection certification from a specialised body in accordance with the rules of the national cyberspace administration authority; (3) concluding a contract with the overseas recipient on the standard contract formulated by the national cyberspace administration authority, agreeing the rights and obligations of both sides; (4) other conditions prescribed by laws, administrative regulations or the national cyberspace administration authority. Paragraph 3: A personal information processor shall take the necessary measures to ensure that the overseas recipient's processing of personal information meets the personal information protection standards laid down in this Law.
Unofficial translation; the Chinese text as officially published prevails.
Paragraph 3 is worth noting separately because it is not a route but a continuing duty: whichever of the routes is used, the processor must take necessary measures to bring the overseas recipient's processing up to the standard the Law sets. That obligation survives every exemption discussed below, because it sits in article 38 and not in the implementing rules.
Which route applies depends on volume, and the volumes were reset in 2024. Order No. 11 of 2022 required a security assessment where a processor had provided, cumulatively since 1 January of the preceding year, the personal information of 100,000 people or the sensitive personal information of 10,000 people. Order No. 16 replaced that structure.
| Volume, counted cumulatively from 1 January of the current year | What is required | Provision |
|---|---|---|
| Operator of critical information infrastructure providing personal information or important data abroad | Security assessment, filed through the provincial cyberspace administration authority | Order No. 16, art. 7(1) |
| Other processor: important data, or 1,000,000 or more people's personal information (excluding sensitive), or 10,000 or more people's sensitive personal information | Security assessment | Order No. 16, art. 7(2) |
| Other processor: 100,000 or more but fewer than 1,000,000 people's personal information (excluding sensitive), or fewer than 10,000 people's sensitive personal information | Standard contract with the overseas recipient, or personal information protection certification | Order No. 16, art. 8 |
| Other processor: fewer than 100,000 people's personal information (excluding sensitive) | Exempt from all three routes | Order No. 16, art. 5(1)(4) |
| Any of the exempt situations in articles 3 to 6 | Those provisions prevail over articles 7 and 8 | Order No. 16, arts. 7, para. 2 and 8, para. 2 |
5. Layer three: the exemption, and what it does not exempt
第五条 数据处理者向境外提供个人信息，符合下列条件之一的，免予申报数据出境安全评估、订立个人信息出境标准合同、通过个人信息保护认证：……（二）按照依法制定的劳动规章制度和依法签订的集体合同实施跨境人力资源管理，确需向境外提供员工个人信息的；……
前款所称向境外提供的个人信息，不包括重要数据。
第十条 数据处理者向境外提供个人信息的，应当按照法律、行政法规的规定履行告知、取得个人单独同意、进行个人信息保护影响评估等义务。
Article 5, paragraph 1: Where a data processor provides personal information outside China and one of the following applies, it is exempt from filing for a data export security assessment, from concluding the standard contract for the export of personal information, and from obtaining personal information protection certification: … (2) where cross-border human resources management is implemented in accordance with employment rules and regulations formulated in accordance with law and a collective contract concluded in accordance with law, and it is genuinely necessary to provide employees' personal information outside China; … Paragraph 2: The personal information provided outside China referred to in the preceding paragraph does not include important data. Article 10: Where a data processor provides personal information outside China, it shall perform the obligations of notification, obtaining the individual's separate consent, and carrying out a personal information protection impact assessment, as prescribed by laws and administrative regulations.
Unofficial translation; the Chinese text as officially published prevails.
Read those two articles in the order they appear and the design is unmistakable. Article 5 removes the three transfer routes for a group running cross-border human resources management on properly adopted rules and a collective contract. Article 10, five articles later, restores in express terms the three obligations that survive: notification, separate consent, and the impact assessment. A group that treats article 5 as a general exemption from Chinese cross-border rules for employee data has read half of the instrument.
第三十九条 个人信息处理者向中华人民共和国境外提供个人信息的，应当向个人告知境外接收方的名称或者姓名、联系方式、处理目的、处理方式、个人信息的种类以及个人向境外接收方行使本法规定权利的方式和程序等事项，并取得个人的单独同意。
Article 39: Where a personal information processor provides personal information outside China, it shall inform the individual of the name of the overseas recipient, the recipient's contact details, the purpose and method of processing, the categories of personal information, and the means and procedure by which the individual may exercise the rights provided in this Law against the overseas recipient, and shall obtain the individual's separate consent.
Unofficial translation; the Chinese text as officially published prevails.
Article 39 sets six items of notification and then requires separate consent. Article 13, paragraph 2 removes the requirement of consent where items (2) to (7) apply, and the Law does not say in terms whether that removal reaches the separate consent in article 39; this page does not resolve that question by inference from the Law's silence. What is express sits in the implementing instrument: article 10 of Order No. 16 provides that a data processor providing personal information outside China shall perform the obligations of notification, obtaining the individual's separate consent and carrying out an impact assessment — and it does so in the same Order whose article 5 grants the human resources exemption, five articles earlier. The operative position therefore rests on that provision. A human resources team relying on employment rules as its processing basis still performs the article 39 notification and obtains separate consent for the transfer.
Two practical consequences follow. First, the notification has to name the overseas recipient — not "the group", not "affiliates" — together with contact details and the route by which the employee can exercise rights against that recipient abroad. Second, because consent must be separate, it cannot be buried in a general employment consent or an onboarding acknowledgement, and a change in the purpose, method or categories of information requires the position to be revisited under article 14, paragraph 2.
6. What has to be done regardless of route
Three further obligations sit outside the route analysis entirely. Article 55(4) requires a personal information protection impact assessment in advance of any provision of personal information outside China, and article 56 sets its three contents — whether the purpose and method are lawful, justified and necessary; the impact on the individual's rights and interests and the security risks; and whether the protective measures are lawful, effective and commensurate with the risk — with paragraph 2 requiring the report and the processing records to be kept for at least three years. Article 41 is the separate prohibition: without the approval of the competent Chinese authorities, a processor may not provide personal information stored in China to a foreign judicial or law enforcement body, which is a distinct question from a routine group transfer and should never be handled on the same authority.
On the consequences side, article 66, paragraph 1 provides for an order to rectify, a warning, confiscation of unlawful gains and, where rectification is refused, a fine of up to RMB 1,000,000 together with a fine of RMB 10,000 to RMB 100,000 on the directly responsible persons in charge and other directly responsible persons; paragraph 2 raises the exposure for serious cases to a fine of up to RMB 50,000,000 or up to 5 per cent of the preceding year's turnover, with suspension of business, revocation of permits or licence, and a possible prohibition on the individuals concerned holding director, supervisor, senior management or personal information protection officer positions for a period. Every filing or certification step referred to above is subject to the current published requirements of the competent cyberspace administration authority.
7. Who runs into this, and how it is used
- Misconception: sending a foreign employee's data back to their home country's head office is not a cross-border transfer. In fact: article 3, paragraph 1 applies the Law to processing in China regardless of the individual's nationality, and the transfer engages articles 38 and 39.
- Misconception: the human resources exemption in article 5 of Order No. 16 removes the Chinese cross-border rules for employee data. In fact: it removes the three transfer routes; article 10 of the same Order keeps notification, separate consent and the impact assessment.
- Misconception: because article 13, paragraph 2 dispenses with consent, no consent is needed for the transfer. In fact: article 10 of Order No. 16 expressly keeps notification, separate consent and the impact assessment in place for a provision of personal information outside China, including where the article 5 exemption applies.
- Misconception: the security assessment threshold is 100,000 people. In fact: that figure comes from article 4 of Order No. 11; articles 7, 8 and 13 of Order No. 16 have superseded it.
- Establish which limb of article 13, paragraph 1(2) is being relied on, and whether the employment rules and regulations were in fact formulated in accordance with law — the provision makes that a condition, not a description.
- Count the volumes on the article 7 and article 8 basis of Order No. 16 (cumulative from 1 January of the current year, sensitive information counted separately), and re-count when headcount or data scope changes.
- Check the transfer notification against the six items in article 39, and in particular whether the overseas recipient is named rather than described.
- Confirm the separate consent is genuinely separate, and that a change of purpose, method or category triggers a fresh position under article 14, paragraph 2.
- Diarise the article 55(4) impact assessment before the first transfer, and hold the report and processing records for the three years required by article 56, paragraph 2.
- Keep any request from a foreign judicial or law enforcement body on a separate track under article 41; it is not a group transfer question.
- Laws and Regulations for Foreign Nationals in China — the provision-by-provision index.
- Work & Invest · Employment Rights and Starting a Business in China.
- Social Insurance for Foreign Employees in China — another dataset that moves between the employer and the authorities.
- The 1996 Employment Rules Are Still the Law: Reading Them After the Paperless Permit (forthcoming in this batch) — where the employment relationship this data describes comes from.
- Data Export in Listing Due Diligence: Choosing Between the Three Routes (forthcoming) — the transaction-side counterpart. That page deals with a one-off export in a transaction; this page deals with continuing export in an employment relationship.
- 《中华人民共和国个人信息保护法》, adopted 2021-08-20, in force from 2021-11-01: http://www.npc.gov.cn/npc/c2/c30834/202108/t20210820_313088.html （articles 3, 4, 13, 14, 38, 39, 40, 41, 55, 56, 66）
- 《促进和规范数据跨境流动规定》, Order No. 16 of the Cyberspace Administration of China, adopted 2023-11-28, promulgated and in force from 2024-03-22: https://www.cac.gov.cn/2024-03/22/c_1712776611775634.htm （articles 3, 4, 5, 6, 7, 8, 9, 10, 13, 14）
- 《数据出境安全评估办法》, Order No. 11 of the Cyberspace Administration of China, promulgated 2022-07-07, in force from 2022-09-01: https://www.cac.gov.cn/2022-07/07/c_1658811536396503.htm （articles 4, 5, 9, 12）
- Status and timing note 效力与时点提示：Verified on 2026-09-07 against the official texts above. Order No. 16 has been in force since 2024-03-22 and, under its article 13, prevails over Order No. 11 and Order No. 13 where they are inconsistent. This page states the thresholds; whether a particular group falls into a particular band is a question of fact about its own volumes. Every filing or certification step is subject to the current published requirements of the competent cyberspace administration authority.
This article is general legal research and does not constitute legal advice; by law, a law firm may not guarantee case outcomes. 本文为一般性法律研究，不构成法律意见；依据法律规定，律所不得承诺办案结果。
