Global products and platforms
Websites, apps, SaaS, e-commerce, advertising, support and analytics serving users in China and abroad.
PIPL · GDPR · DATA TRANSFERS
Cross-Border Data Compliance
Align data flows, contractual responsibility and product operations in a compliance programme the business can use.
Cross-border data compliance is not solved by adding language to a privacy notice. The business must know where data comes from, why it is processed, who makes decisions, where it travels, how long it is retained and who responds to an incident. China's Personal Information Protection Law, data-security rules, the GDPR and local laws may apply to the same flow. Ada Ren helps businesses connect data mapping, lawful basis, notice and consent, transfer mechanisms, vendor contracts, internal governance and product design.
China data compliance lawyerChina PIPL compliancecross-border data transfer ChinaChina privacy lawyer
Situations and issue spotting
Business activities that require review
When personal information or important business data crosses borders, legal, product and technical teams must work together.
Intra-group data sharing
Chinese entities sharing employee, customer, supplier, financial or operational data with overseas headquarters.
Overseas vendors and cloud tools
International CRM, email, collaboration, storage, AI or analytics tools processing China-related data.
Investment, M&A and data transactions
Diligence, closing, system integration, data-product circulation and joint development.
Key legal questions
Core implementation modules
Rules should follow the data lifecycle, not sit in isolated documents.
Data map and roles
Identify categories, subjects, purposes, systems, storage, recipients and controller, processor or entrusted-party roles.
Lawfulness and transparency
Confirm legal basis, necessity, notice, consent, sensitive information, children's data and rights handling.
Transfer mechanism
Assess security review, standard contract, certification, separate consent, impact assessment and local transfer tools.
Contracts and governance
Allocate security, audit, sub-processing, incident notice, deletion and return responsibilities.
Working pathway
From mapping to ongoing governance
Prioritise high-risk flows and gaps that most directly affect launch or operations.
- 01
Scope and mapping
Interview business and technical teams and map priority flows, systems, entities and jurisdictions.
- 02
Gap and risk ranking
Compare applicable rules with documents and operations, then rank regulatory and business impact.
- 03
Document and product remediation
Update privacy materials, DPAs, consent, permissions, retention and vendor controls.
- 04
Training and monitoring
Implement incident, rights, vendor-review, recordkeeping and new-project assessment processes.
Document checklist
Materials for a data review
A review can start with the highest-risk product or flow before the enterprise map is complete.
- 01Business, product, system and data-flow descriptions
- 02Privacy notices, consent text and user terms
- 03DPAs, vendor and cloud agreements
- 04Data fields, location, retention and access rights
- 05Overseas recipient, purpose and onward-transfer arrangements
- 06Security policies, incident records and rights procedures
Multi-jurisdiction strategy
Connecting China, EU and other regimes
The same flow may be a personal information export under Chinese law, an international transfer under the GDPR and a locally regulated disclosure at destination. Documents should reflect the real flow, not combine templates without analysis.
Ada has worked on a bilingual DPA for processing across Europe and Asia and on compliance review for enterprise-credit data products. Technical controls remain the responsibility of technology and security specialists; legal work defines applicable rules, accountability and auditable governance.
CHINA · AUSTRALIA · NEW ZEALAND
Ada Ren
Partner · Lawyer admitted in China, New South Wales and New ZealandLL.M., Fudan University; Juris Doctor, UNSW. Bilingual counsel for cross-border disputes, investment, contracts, IP, data compliance and international family matters.Professional foundation
Relevant professional foundation
Public reporting describes work on a bilingual GDPR-aligned data processing agreement for a digital-services business and participation in the compliance assessment of enterprise-credit data products for circulation on the Shenzhen Data Exchange. Every project still requires a current, flow-specific review.
LEGAL INSIGHTS
Legal insights related to this capability
Continue with rule analysis, risk identification and practical action lists.
Data & Privacy
China Cross-Border Data Transfers in 2026: A Six-Step Compliance Framework
A practical 2026 guide to China cross-border data transfer compliance, covering security assessments, standard contracts, certification, exemptions and PIPL audits.
Read insight →EU Market AccessEU PPWR Applies from 12 August 2026: Seven Actions for China Exporters
A practical legal update for China exporters, e-commerce sellers and EU importers on immediate PPWR chemical, conformity and EPR checks, plus the 2028–2030 packaging roadmap.
Read insight →FAQ
Cross-border data compliance FAQ
01Does using an overseas cloud service always mean a data export?＋
The actual storage, access and processing path matters. Overseas remote access may be relevant even where a server is in China, while irreversibly anonymised information may no longer be personal information.
02Is consent enough for an overseas transfer?＋
Usually not by itself. Necessity, notice, separate consent, sensitive information, impact assessment and any security review, standard contract, certification or other mechanism must be considered.
03Can GDPR and PIPL use one set of documents?＋
They can share a data map and governance framework, but roles, lawful bases, transfer tools, rights timelines and regulator expectations differ. Jurisdiction-specific provisions are normally required.
START A CONVERSATION
Early clarity on jurisdiction and evidence creates room to act.
For an initial enquiry, identify the jurisdictions, type of matter, critical dates and documents available.
Call+86 152 2181 9596Send a matter summaryrenfeifei@huashang.cn
WeChatWeChat ID: 15221819596Scan the QR code to connect