The China IT navigator for foreign companies

Often yes (that is the most common setup for foreign SMEs), but only with proper connectivity. Over the public internet the experience ranges from sluggish to unusable; over licensed circuits or a good SD-WAN it works well. The alternative is a separate 21Vianet tenant: fast and local, but separate identities, no Copilot, and real friction collaborating with your global tenant. It's a genuine architecture decision; our guide to Microsoft 365 in China walks through it.

Corporate cross-border connectivity is legal when it runs on channels from licensed carriers: leased circuits, MPLS, or SD-WAN over a licensed underlay, registered to your entity for internal use. Consumer VPN apps are a different matter: periodically disrupted, outside any service guarantee, and not something to build a business process on. If your acquired company "solves China" with a consumer VPN subscription, that's a finding, not a solution.

It can. PIPL reaches foreign companies that sell products or services into China or analyse the behaviour of people in China, and since January 2025 the Network Data Security Management Regulations require such companies to designate a representative or institution in China and report it to the authorities. No entity does not mean no obligations.

Usually yes, and more easily than people fear: the 2024 cross-border rules exempt employee data transferred for genuine HR management from all three transfer mechanisms, regardless of volume. You still need PIPL-compliant notices and, in practice, clean records of what goes where, but the routine global-HR scenario is no longer the blocker it briefly was.

Only at scale or sensitivity: the assessment applies from 1 million individuals, 10,000 sensitive-data individuals, any "important data", or if you're critical infrastructure. Between 100,000 and 1 million non-sensitive individuals it's an SCC filing; below 100,000, no mechanism at all. Most foreign SMEs land in the exempt or SCC bands, but someone has to do the counting and keep it current.

Realistically, no. Google's services are blocked in the mainland, so every user would depend on cross-border circuits for email and files: fragile and expensive. Companies standardised on Workspace globally usually run their mainland staff on Microsoft 365 or a local stack and bridge the two, rather than fighting the firewall daily.

If you serve the public from hosting inside mainland China (a website, a portal, an app backend), yes: at least an ICP filing, which needs a Chinese business licence, and a commercial ICP licence for paid online services. Serving China from Hong Kong avoids ICP at the cost of performance. An acquired business running on a vendor's or founder's filing is a risk to fix, not a convenience to keep.

They're separate worlds. AWS China (Beijing under Sinnet, Ningxia under NWCD) and Azure China (21Vianet) run as physically separate regions with separate accounts, requiring a Chinese business licence, and anything public-facing needs its ICP filing in the hosting region. Global-account resources and China-account resources don't mingle; architect for two estates with controlled bridges.

China's mandatory grading scheme for systems operated in the mainland. You classify each system Level 1–5; Level 2+ gets filed with the public security bureau and Level 3+ needs annual assessment. A foreign SME's China file server or local ERP is typically Level 2: light-touch, but it's a filing that inspectors and incident investigations expect to see.

No, and this is the most common misconception we see. A licensed circuit answers TRANSPORT: it is the compliant, reliable way to carry cross-border corporate traffic, and it makes your connectivity problems go away. It says nothing about whether the personal data on that circuit is allowed to leave China. That is a separate question answered by the transfer mechanisms: exempt below 100,000 non-sensitive individuals, an SCC filing between 100,000 and 1 million, a CAC security assessment above that or for sensitive data at scale. You can buy the best circuit available and still need the filing. The architecture builder on this page shows exactly this: choose a licensed route and the connectivity flags clear while a customer database crossing the border stays flagged.

All three are licensed routes, and the right one depends on shape. An IPLC or IEPL is a dedicated point-to-point circuit between your mainland site and a termination point outside it: the most predictable, the slowest to provision, and priced per megabit. MPLS is a carrier-run private WAN joining several sites with managed quality of service, which makes sense once you have multiple China and regional offices. SD-WAN over a licensed underlay is a managed overlay that routes per application, keeping local traffic local and sending only what must leave over the licensed path, and it is the usual modern answer for a China office that needs global Microsoft 365 plus good local speed. The warning sign is a vendor who cannot name the licensed carrier underneath their SD-WAN.

Yes. A backup or DR copy replicates everything in the systems it protects, so pushing China backups to storage or a cloud region outside the mainland transfers personal data at full volume — plus anything that could be classed "important data" under the Data Security Law. The volume exemptions that might cover a single business flow rarely fit a whole-estate backup set. The usual answers are a mainland backup tier for China systems, or a deliberately scoped, counted and documented off-mainland copy under the same transfer mechanism as your live flows. What does not work is discovering the backup job in a compliance review.

Mostly, and for a reason worth understanding: on international roaming, traffic breaks out through the home carrier, so the global stack — mail, files, even blocked services — generally works as it does at home. Connect the same device to hotel Wi-Fi or a local SIM and it is on the Chinese internet, where the usual blocks and slowdowns apply, and per-device VPN apps are not a dependable or compliant answer. For visits, roaming is the pragmatic approach; for anything sustained — a team, an office, a project — that is what licensed connectivity is for.

Frequently nothing, until something forces the question: an incident with a 24-hour reporting clock, a customer or partner audit, a deal's due diligence, or a takedown of an unfiled site. PIPL fines reach RMB 50 million or 5% of turnover at the top end; the everyday cost is a China operation running on connectivity and filings that can vanish without notice. The fix is rarely expensive; discovering the gap mid-crisis is.