The China IT navigator for foreign companies

Often yes — that is the most common setup for foreign SMEs — but only with proper connectivity. Over the public internet the experience ranges from sluggish to unusable; over licensed circuits or a good SD-WAN it works well. The alternative is a separate 21Vianet tenant: fast and local, but separate identities, no Copilot, and real friction collaborating with your global tenant. It's a genuine architecture decision — our guide to Microsoft 365 in China walks through it.

Corporate cross-border connectivity is legal when it runs on channels from licensed carriers — leased circuits, MPLS, or SD-WAN over a licensed underlay, registered to your entity for internal use. Consumer VPN apps are a different matter: periodically disrupted, outside any service guarantee, and not something to build a business process on. If your acquired company "solves China" with a consumer VPN subscription, that's a finding, not a solution.

It can. PIPL reaches foreign companies that sell products or services into China or analyse the behaviour of people in China — and since January 2025 the Network Data Security Management Regulations require such companies to designate a representative or institution in China and report it to the authorities. No entity does not mean no obligations.

Usually yes, and more easily than people fear: the 2024 cross-border rules exempt employee data transferred for genuine HR management from all three transfer mechanisms, regardless of volume. You still need PIPL-compliant notices and, in practice, clean records of what goes where — but the routine global-HR scenario is no longer the blocker it briefly was.

Only at scale or sensitivity: the assessment applies from 1 million individuals, 10,000 sensitive-data individuals, any "important data", or if you're critical infrastructure. Between 100,000 and 1 million non-sensitive individuals it's an SCC filing; below 100,000, no mechanism at all. Most foreign SMEs land in the exempt or SCC bands — but someone has to do the counting and keep it current.

Realistically, no. Google's services are blocked in the mainland, so every user would depend on cross-border circuits for email and files — fragile and expensive. Companies standardised on Workspace globally usually run their mainland staff on Microsoft 365 or a local stack and bridge the two, rather than fighting the firewall daily.

If you serve the public from hosting inside mainland China — a website, a portal, an app backend — yes: at least an ICP filing, which needs a Chinese business licence, and a commercial ICP licence for paid online services. Serving China from Hong Kong avoids ICP at the cost of performance. An acquired business running on a vendor's or founder's filing is a risk to fix, not a convenience to keep.

They're separate worlds. AWS China (Beijing under Sinnet, Ningxia under NWCD) and Azure China (21Vianet) run as physically separate regions with separate accounts, requiring a Chinese business licence — and anything public-facing needs its ICP filing in the hosting region. Global-account resources and China-account resources don't mingle; architect for two estates with controlled bridges.

China's mandatory grading scheme for systems operated in the mainland. You classify each system Level 1–5; Level 2+ gets filed with the public security bureau and Level 3+ needs annual assessment. A foreign SME's China file server or local ERP is typically Level 2 — light-touch, but it's a filing that inspectors and incident investigations expect to see.

Frequently nothing — until something forces the question: an incident with a 24-hour reporting clock, a customer or partner audit, a deal's due diligence, or a takedown of an unfiled site. PIPL fines reach RMB 50 million or 5% of turnover at the top end; the everyday cost is a China operation running on connectivity and filings that can vanish without notice. The fix is rarely expensive; discovering the gap mid-crisis is.