The short answer: strictly governed by the Personal Information Protection Law (PIPL) and related statutes. With the Cybersecurity Law, Data Security Law, and PIPL now in force, China's requirements for employee data protection have become increasingly strict — cross-border transfers especially so.
Legal basis
- Article 13 of the PIPL: processing personal information requires the individual's consent (or another legal basis).
- Articles 38 and 39 of the PIPL: cross-border transfers must go through compliant paths (security assessment, standard contract, etc.) plus notice and separate consent.
- The Data Security Law: data processors must establish full-process data security management.
Key points
- Basic employee data necessary to perform the contract or manage HR may be processed without separate consent; sensitive personal information beyond what is necessary requires separate consent.
- Keep personal information secure — prevent leakage, alteration, and loss.
- Cross-border transfers (e.g., sending employee data to an overseas HQ) are tightly restricted and need a compliant path plus separate consent.
- Sensitive personal information (biometrics, health data) gets even higher protection.
Practical tips
- Run a cross-border data assessment before transferring data, and be extra careful with sensitive data.
- Promptly dispose of or delete unnecessary personal data after an employee leaves.
Note for foreign employers
- Sign compliant agreements covering data processing with vendors and outsourcers.
Note for foreign employers
- Establish a data-security incident response plan.
- If your HQ is in the EU, manage both GDPR and PIPL compliance to avoid two-way cross-border transfer risk.
For any multinational moving employee data across borders, data compliance demands early and ongoing attention — not after a breach. Need data-compliance support? Contact CRBPO.
About CRBPO
Founded in 2003, CRBPO (中瑞岳华) is a professional HR service provider with 20+ years in the China market, offering executive search, RPO recruitment, staffing & dispatch, global EOR, tax & accounting, and monthly HR subscription — across 30+ cities — to help foreign companies run compliant, efficient operations in China.
Follow us: WeChat Official Account "中瑞岳华科技服务" | LinkedIn; Hotline: 400-658-9852; Email: os@crbpo.com.