Glossary
Data Residency in China
Definition
Data residency in China is the requirement that personal information collected and generated inside the mainland be stored on servers inside the mainland — for a defined class of operators. It is a localization obligation under the Personal Information Protection Law (PIPL), not a general rule that applies to every dataset every company holds. Cross-border transfer of that data is permitted only after the processor satisfies one of the transfer mechanisms Article 38 prescribes.
What data residency in China is
- A storage obligation for a defined class. Article 40 of the PIPL imposes it on two categories: critical information infrastructure operators, and processors whose personal-information volume reaches the prescribed quantity. Both must store mainland-collected and -generated personal information inside the mainland. Whether you fall into either category turns on the prescribed thresholds.
- Paired with cross-border transfer mechanisms. When data in this class must move abroad — for CRM sync, analytics, or HQ reporting — Article 38 provides three mechanisms: a security assessment organized by the national cyberspace department, certification by a professional institution under its rules, or the standard contract that department issues with the overseas recipient. The processor must also notify the individual and obtain separate consent (Article 39). The full mechanics are in our PIPL term page.
- A default-in-mainland posture, not an absolute bar on transfer. Data localization is the default storage position for the defined class. Cross-border provision from that class passes the security assessment — the first Article 38 mechanism above. Operations outside the defined class are not subject to the localization mandate, though other PIPL obligations (consent, transfer mechanisms, Article 3's offshore reach) still apply.
- Distinct from the ICP filing. A domain name without ICP filing "is not allowed to be online, and a filed domain name must be resolved to a filed IP address" — that is the ICP pipeline, not data residency. The ICP filing registers a mainland-hosted site with MIIT. Data residency governs where personal information sits. They are separate instruments with separate authorities.
Sources: PIPL Articles 38–40 on this site; Microsoft Learn — Data sovereignty and China regulations, accessed 2026-10-02 (FAQ section updated January 2023 — treat specific threshold figures as vintage-dated; verify current CAC rules before relying on them).
What data residency in China does NOT mean
- Not a blanket rule for all data. Localization applies to a defined class of processors — not to every company that touches mainland users' data. A marketing site with no personal-information processing above the prescribed thresholds does not trigger the storage mandate.
- Not the ICP filing. The ICP filing pipeline — provider submission, 12381 SMS verification, provincial review, number issuance, public-security registration — contains no data-residency step. PIPL is a separate statute from a separate authority.
- Not PIPL itself. Data residency is one obligation inside the PIPL. The law also covers consent, cross-border transfer mechanisms, and offshore applicability (Article 3). Conflating the storage rule with the entire statute misses the other obligations.
- Not an infrastructure property you can buy. Selecting a mainland CDN or hosting provider addresses performance and filing obligations. It does not, by itself, satisfy data-residency requirements — those are legal obligations tied to the processor's classification, not a server location you provision.
- Not limited to mainland-hosted sites. Article 3 extends PIPL to offshore processing when the purpose is offering products or services to mainland persons or analyzing their behavior. Hosting location alone does not determine whether the law reaches your operation.
What triggers localization — and what does not
Trigger: The processor is a critical information infrastructure operator, or its personal-information processing volume reaches the prescribed quantity (Article 40). From that class, mainland-collected and -generated personal information must be stored inside the mainland.
Not a trigger: Serving mainland users from offshore alone. Article 3 extends PIPL's processing obligations to offshore operations targeting mainland persons — but the storage-localization mandate in Article 40 turns on the prescribed thresholds, not on whether you serve mainland users. An offshore site that processes mainland persons' data below the prescribed volume is subject to PIPL's general obligations, not the localization rule.
Not a trigger: Mainland hosting by itself. Hosting on Alibaba Cloud, Tencent Cloud, Azure China, or AWS China Regions addresses the ICP filing obligation and performance. It does not determine whether Article 40's localization mandate applies — that question depends on the processor's classification and volume.
Why it matters for foreign companies
Regulated industries hit this first. Fintech and other regulated operations that process personal information at volume need to determine whether they fall into the Article 40 class before architecture decisions lock in offshore data flows. Plan the classification assessment before the integration goes live.
Cross-border transfers need a mechanism, not just a server. If your China operation sends personal information to servers abroad — for CRM, analytics, or HQ reporting — Article 38 prescribes the mechanisms. Article 39 adds the notification and separate-consent requirement. The server location is one piece; the transfer basis is the other. The full mechanism ladder and the 2024 exemptions live on our cross-border data transfer page.
Mainland hosting is necessary but not sufficient. Hosting in the mainland addresses the ICP filing gate and performance. Data residency is a separate legal layer. The two plans run in parallel, not sequentially.
The deeper legal mechanics — the three transfer mechanisms, the separate-consent requirement, the offshore-reach provision — live in our PIPL term page. For the operational layer — what a foreign company actually implements — see our PIPL compliance for foreign companies article.
Common misconceptions
"Data residency means all our data must stay in China." It does not. The localization mandate applies to a defined class of processors above prescribed thresholds. Other data, and operations below those thresholds, are not subject to the storage requirement — though PIPL's other obligations still apply.
"Hosting in China solves data residency." Mainland hosting addresses the ICP filing and performance. Data residency is a classification question under PIPL, not a server location.
"Data residency is the same as the ICP filing." They are separate instruments. The ICP filing registers a mainland-hosted site with MIIT. Data residency governs where personal information sits under the PIPL.
Frequently asked questions
What is data residency in China?
Data residency in China is the requirement that personal information collected and generated inside the mainland be stored on servers inside the mainland — for a defined class of operators. It is a localization obligation under the Personal Information Protection Law (PIPL), not a general rule that applies to every dataset every company holds.
When does data residency apply to a foreign company?
The localization mandate applies when the processor is a critical information infrastructure operator or when its personal-information processing volume reaches the prescribed quantity. Serving mainland users from offshore alone does not trigger the storage mandate — the storage-localization mandate turns on the prescribed thresholds, not on whether you serve mainland users. An offshore site that processes mainland persons’ data below the prescribed volume is subject to PIPL’s general obligations, not the localization rule.
How does data residency relate to PIPL and cross-border transfer rules?
Data residency is one obligation inside the PIPL — the law also covers consent, cross-border transfer mechanisms, and offshore applicability. When data in the localized class must move abroad, the law provides three transfer mechanisms: a security assessment organized by the national cyberspace department, certification by a professional institution under its rules, or the standard contract that department issues with the overseas recipient. The processor must also notify the individual and obtain separate consent.
What are the common misconceptions about data residency in China?
The first is that data residency means all data must stay in China — the localization mandate applies to a defined class of processors above prescribed thresholds, not to every company. The second is that hosting in China solves data residency — mainland hosting addresses the ICP filing and performance, but data residency is a classification question under PIPL, not a server location. The third is that data residency is the same as the ICP filing — they are separate instruments with separate authorities.
What should a company do first when assessing data residency obligations?
Determine whether the operation falls into the defined class before architecture decisions lock in offshore data flows. If the China operation sends personal information to servers abroad — for CRM, analytics, or HQ reporting — the transfer requires a mechanism, not just a server. Hosting in the mainland addresses the ICP filing gate and performance, but data residency is a separate legal layer — the two plans run in parallel, not sequentially.
Related terms
- PIPL (个人信息保护法) — governs the processing of personal information in the mainland.
- Cross-Border Data Transfer in China — the provision of personal information collected inside the mainland to a recipient outside the mainland.
- Bei’an (备案) — ICP Filing — the mandatory registration for most websites hosted on mainland servers.
- Data Security Law (DSL) — China’s framework law for data processing; source of the "important data" trigger that feeds the cross-border security assessment.
Related reading
- PIPL (个人信息保护法) — the statute behind data residency; Article 38 transfer mechanisms, Article 39 consent, Article 40 localization trigger.
- PIPL Compliance for Foreign Companies — the operational walkthrough of the obligations these transfer mechanisms serve.
- ICP Filing (Bei'an) — the filing obligation that follows from mainland hosting; separate from data residency.
- Azure China (21Vianet) — physically separated cloud in the mainland; data residency context sits alongside the hosting decision.
- AWS China Regions — the parallel construct on the Amazon Web Services side.
- Data Security Law (DSL) — the grading law behind the "important data" trigger; it feeds the transfer-assessment ladder, not the Article 40 localization trigger.
- Cybersecurity Law (CSL) — the framework cybersecurity statute; its Art. 76 "network operator" definition scopes network obligations, not the Article 40 storage trigger.
- ICP Compliance Service — how we coordinate filing, entity, and hosting decisions.
- Infrastructure Service — mainland hosting and CDN setup on licensed operators.
- China Digital Entry Glossary — the full term set in one place.
Processing mainland users’ personal information at volume — and need to determine whether Article 40’s localization mandate applies?
We coordinate the classification assessment, hosting decisions, and cross-border transfer planning. Start with the ICP & compliance service or the 10-point China readiness diagnostic.
hello@chinagateway.pro