Sending China employee data to overseas headquarters: the HR exemption

1. Map what headquarters can actually see

List the China employing entity, overseas recipients and service providers, access locations, users, purposes, data fields and retention periods. Include attachments and remote access, not only exported spreadsheets. The CAC’s October 2025 Q&A explains that overseas access to data stored in China can be a data export. Access by a foreign organization’s staff while in China, without transferring data abroad, is not treated as export merely because the organization is foreign.

For each requested field, record the actual HR decision and why identifiable information must reach that recipient. For example, ask whether headquarters needs each bank-account number or only a payroll total; this is a necessity question, not an assumption that either arrangement is always lawful. Keep optional group analytics and recruitment files separate from employee administration. A single system can contain flows with different legal bases.

2. Document the HR exemption instead of assuming group-wide coverage

Article 5(1)(2) of the Provisions on Promoting and Regulating Cross-Border Data Flows covers employee information genuinely necessary for cross-border HR management under lawfully formulated labor rules and lawfully concluded collective contracts. It exempts qualifying transfers from security-assessment declaration, conclusion of the prescribed export standard contract and personal-information protection certification. Article 5 excludes important data. If the conditions are not established, assess the applicable export route separately before access begins.

Keep the actual China rules, collective-contract materials and evidence of their lawful adoption and implementation. A headquarters template or a statement that the platform is convenient is insufficient. The October 2025 Q&A requires a fact-specific necessity and minimization analysis for employee IDs, passports and bank accounts. The exemption is not a universal permission to upload these documents. Remove fields or restrict overseas access when the project cannot justify them.

3. Separate the consent question from the export mechanism

PIPL Article 13 provides lawful bases for processing, including necessary HR management under the specified lawful rules and collective contracts. The CAC’s July 2026 Q&A confirms that an export falling within Article 13(1)(2)–(7) does not require individual consent, but still requires an export notice. Record why the particular activity meets a non-consent basis. Eligibility for an export-mechanism exemption alone is not that analysis.

The notice should identify the overseas recipient and contact details, purposes, processing methods, information categories and procedures for exercising rights against that recipient under Article 39. Also address the general notice requirements, including retention, under Article 17. Where separate consent is required, obtain a specific, informed choice rather than bundled authorization. For sensitive information, review the particular purpose, sufficient necessity, strict safeguards and additional explanation of necessity and impact under Articles 28–30.

4. Assess recruitment uploads on their own facts

The July 2026 Q&A draws a concrete boundary: where overseas headquarters or an affiliate does not participate in China hiring decisions, exporting applicants’ CVs lacks necessity. Where it directly participates, limit the applicants and fields to the minimum needed for that decision and apply the relevant export requirements. Do not automatically classify every applicant as an employee covered by the HR exemption.

Before enabling a global recruitment module, identify who actually makes the decision, which candidates need overseas review and when access ends. A broad talent pool for future group vacancies is a different purpose from deciding one China vacancy. Assess that purpose and its legal basis separately; do not reuse a current hiring justification without checking it. Record this distinction in the system permissions and notice, not only in a legal memo.

5. Complete the assessment and launch dossier

PIPL Articles 55–56 require a prior personal information protection impact assessment for overseas transfers and records of processing. Examine lawfulness, necessity, effects on individuals, risks and safeguards. Keep the assessment report and processing records for at least 3 years. This is not a direction to retain every underlying personnel document for 3 years: Article 19 generally requires the shortest period necessary for the purpose, unless laws or administrative regulations provide otherwise.

Prepare the data-flow map, field-by-field necessity analysis, rules and collective-contract file, exemption or alternative-route assessment, notices and any required consent evidence, impact assessment, recipient arrangements and access controls. Article 38 requires measures ensuring the overseas recipient meets PIPL protection standards; an entrusted service provider also needs the Article 21 contractual and supervisory arrangements. Assign responsibility for deletion, rights requests and incidents. Recheck the analysis before adding recipients, fields or new uses.

For initial legal review, send a non-confidential description of the China entity, HR purpose, recipient locations, approximate staff scale and proposed data categories. Do not send employee IDs, bank details or CVs with the first inquiry. Agree a secure review process for the detailed file.