1. The first four steps
First, verify the person's identity, investigating authority, place of custody, alleged matter, documents issued and the next known procedural date. Second, have an eligible family member or other proper principal instruct a PRC-admitted criminal defence lawyer. Third, assemble passport, nationality, visa or work-permit, health, medication, role and authority records. Fourth, issue a no-deletion preservation hold over phones, email, servers, payments, contracts and meeting records.
Do not allow multiple colleagues to give speculative accounts to investigators, counterparties or the media. Do not ask staff to delete messages, recreate records or align their recollections. If there is a risk of self-harm, an acute medical condition, essential medication or a serious language barrier, provide specific records promptly through counsel and the appropriate channel.
2. Confirm the legal status before choosing a response
A person described as having been 'taken away' may be assisting an inquiry, summoned, involved in an administrative case or held under a criminal compulsory measure. Record the last contact, location, officers or telephone details, vehicle, employer notice and every written document, then verify through a responsible authority and counsel rather than relying on hearsay.
This guide addresses a foreign national entering a criminal investigation in mainland China. It does not cover diplomatic immunity, military process, Hong Kong or Macao procedure, and it does not treat administrative and criminal detention as equivalent. The suspected offence, location and investigating body can change access, approval, timing and consular steps.
3. Who may appoint counsel, and what can counsel do?
Article 34 of the Criminal Procedure Law gives a suspect the right to appoint defence counsel from the first interrogation or compulsory measure. During investigation, defence counsel must be a lawyer. If the person is detained, a guardian or close relative may appoint counsel. A foreign lawyer does not automatically have standing to act as defence counsel in a PRC criminal case; a PRC-admitted lawyer is required.
Counsel can verify custody and case information, request a meeting, understand the suspected offence and relevant circumstances, provide legal assistance, submit complaints, apply to vary compulsory measures and present defence views. Article 39 states that a detention centre should arrange a requested lawyer meeting promptly and no later than 48 hours; national-security and terrorism cases have special permission rules during investigation that counsel must check in the individual case.
4. Family notice, consular contact and interpretation
The Criminal Procedure Law addresses transfer to a detention centre and notice to family after detention, with exceptions where notification is impossible or may obstruct investigation in specified cases. A family that has not received notice should not infer the place of custody or legality from that fact alone. Counsel should verify with the authority and detention centre.
Consular notification, access and assistance for a foreign national also depend on nationality, applicable treaties, reciprocity and the public-security criminal procedure rules. A consulate may provide contacts and practical assistance; it does not replace defence counsel or direct the court or investigators. Any interpretation or language-comprehension issue should be documented with dates and documents and raised promptly through counsel.
5. Build a structured information pack
A structured record is more useful than a mass of forwarded chat messages. Divide it into identity and health, procedural contacts, chronology, corporate role and authority, contracts and payments, and electronic records. State which facts are first-hand and which are reported by others.
If the matter concerns business activity, identify whether the individual controls company chops, online banking, finance systems, servers, customer accounts or safety-critical facilities. Use documented dual approvals, access suspension or continuity controls without altering historical records. Any internal interviews must account for criminal procedure, employment law, data transfer and potential conflicts between company and individual.
- Passport, nationality, visa or residence, work permit and emergency contacts
- Detention notice, summons, seizure list, authority and case reference
- Medical conditions, medication, allergies, emergency records and language needs
- Chronology, contracts, payments, meetings and travel
- Company role, chops, bank, system, device and approval authority
- Native messages, email, file versions, access logs and backup locations
6. Mistakes an employer should avoid
The most damaging response is to substitute public relations for evidence governance: deleting adverse material, coaching a common narrative, approaching witnesses, remotely accessing a seized or relevant device, backdating documents or exporting data. These steps can alter the evidentiary position, create separate compliance problems and prejudice both the company and the individual.
Payment of an employee's legal fees does not mean one lawyer can or should represent both company and individual. If the investigation concerns corporate policy, management instruction, expenses or internal reporting, their interests may diverge. Identify the client, confidentiality boundary, information-sharing protocol and conflict process early.
- Do not delete, rename, overwrite or remotely clean devices or accounts
- Do not coach witnesses or recreate documents from memory
- Do not approach a complainant, witness or key counterparty without legal review
- Do not send sensitive records to overseas headquarters or private email automatically
- Do not promise an outcome, publish case details or attack investigators
7. First 24 and 72 hours
The time for requesting approval of arrest after criminal detention depends on the case category and any lawful extension. A statutory maximum is not a guaranteed release date. Counsel should build the case timetable from the documents, authority confirmation and actual procedural decisions.
- First 24 hours: verify identity, authority, location, documents and medical needs
- First 24 hours: identify a proper principal and instruct PRC criminal counsel
- First 24 hours: preserve calls, email, devices, payments, contracts and access logs
- By 48 hours: give counsel a structured chronology, identity pack and authority list
- By 48 hours: have counsel verify meeting, notice, interpretation and consular routes
- By 72 hours: assess separate representation and any privileged internal review
- By 72 hours: approve business continuity and controlled internal and external communications
Conclusion
The highest-value early response is to verify the procedure, appoint qualified PRC counsel, protect medical and language needs, preserve original evidence and define the interests of the employer and individual. Consular and employer support can be important, but neither substitutes for criminal defence or a case-specific timetable. This is general information; an urgent matter requires advice based on the authority, location, allegation and current documents.

