- Cross-border transfers of employee personal information are exempt from the security-assessment, standard-contract and certification routes where they implement cross-border HR management under a duly adopted labour rule or collective contract.
按照依法制定的劳动规章制度和依法签订的集体合同实施跨境人力资源管理的员工个人信息出境，可免予安全评估、标准合同与认证。- A Personal Information Protection Impact Assessment (PIPIA) is still mandatory for any cross-border HR data transfer, and the report must be retained for at least three years.
任何跨境人力资源数据传输仍须开展个人信息保护影响评估，报告须至少保存三年。- Separate consent and prior notice to the employee are required before sending their data offshore, unless a specific exemption applies.
向境外提供员工数据前须取得单独同意并告知员工，除非适用特定豁免。- Non-employees — candidates, contractors, dependants — generally fall outside the HR-management exemption and need their own lawful basis, often the sub-100,000-record threshold or a formal route.
非员工（候选人、承包商、家属）通常不在人力资源管理豁免范围内，须有自身合法基础，常为不满 10 万人门槛或正式路径。- Foreign groups should sign a cross-border data-processing agreement with the offshore parent, complete the PIPIA, and align HR systems hosted outside China with the exemption’s substance conditions.
外国集团应与境外母公司签署跨境数据处理协议、完成影响评估，并使境外托管的 HR 系统符合豁免的实质条件。
Cross-Border HR Data and PIPIA: Personal Information Compliance for Expatriate Workforces | 跨境人力资源数据与影响评估：外籍员工个人信息合规
Why this matters now
Multinational groups run their human resources on global systems — a payroll platform in Singapore, a recruiting tool in the US, a shared service centre in Europe. For a China subsidiary, that convenience collides with the Personal Information Protection Law (PIPL) and the data-export rules: every time an expatriate’s or local employee’s record is read from, or uploaded to, a server outside China, a cross-border transfer of personal information has occurred. The rules are not a blanket ban, but they impose a compliance stack that many foreign HR teams underestimate. The October 2025 CAC *Policy Q&A on Data Export Security Management* clarified the most important relief — the cross-border HR-management exemption — and how the standard-contract filing and the PIPIA obligation interact with it. This article is a practical map for foreign-invested enterprises.
The legal baseline
Under PIPL (effective 1 November 2021) and the *Provisions on Promoting and Standardising Cross-Border Data Flows* (CAC Decree No. 16, effective March 2024), a personal-information handler that needs to provide personal information overseas must satisfy one of three mechanisms:
- a security assessment organised by the Cyberspace Administration of China (CAC);
- personal-information protection certification by a professional institution; or
- a standard contract with the overseas recipient, filed with the provincial CAC.
Additionally, PIPL Article 38 requires the handler to take necessary measures so the overseas recipient processes the data to PIPL’s standard, and Article 39 requires separate consent and prior notice to the individual (name/contact of the recipient, purpose, manner, types of data, and how the individual exercises their rights).
The HR-management exemption
The 2024 Provisions and the 2025 CAC Q&A confirm a critical exemption: a handler is exempt from the security assessment, standard contract and certification where it provides employee personal information overseas to implement cross-border human-resource management in accordance with a duly adopted labour rule-making procedure and a lawfully concluded collective contract.
Two conditions must hold:
- The cross-border transfer must be necessary for implementing HR management — the Q&A indicates this covers the everyday personnel and routine business-management scenarios: onboarding submissions, compensation and benefits administration, performance evaluation, and internal compliance flows.
- The basis must be a labour rule or collective contract adopted through the statutory democratic and publicity procedure (soliciting employee opinion, consulting the union/employee representatives, and publishing to all staff). The Q&A stresses that enterprises should adopt or localise their employee privacy / PI-protection policy through this procedure so the exemption actually applies.
A second, volume-based exemption also helps: a non-CIIO handler that, from 1 January of the current year, cumulatively provides fewer than 100,000 individuals’ personal information (excluding sensitive PI) overseas is exempt. Non-employees (candidates, contractors, dependants) are generally outside the HR-management exemption and may rely on this sub-100,000 threshold or a formal route instead.
The PIPIA is not waived
Crucially, the exemptions remove the *mechanism* (assessment/contract/certification) but not the surrounding duties. The 2025 Q&A reaffirms that, even where the HR-management or volume exemption applies, the handler must still:
- perform a Personal Information Protection Impact Assessment (PIPIA) before the transfer, covering (i) lawfulness, legitimacy and necessity of purpose and manner; (ii) impact on individuals’ rights and security risks; and (iii) the protections’ adequacy;
- retain the PIPIA report and processing records for at least three years;
- obtain separate consent and give prior notice to the individual unless another lawful basis applies;
- put in place a cross-border data-processing agreement with the overseas recipient (typically the offshore parent or affiliate) ensuring PIPL-standard protection.
The Q&A also clarifies standard-contract practice: where the same overseas recipient and a predictable annual volume are involved, a handler may file one contract rather than repeatedly; if cumulative exports from 1 January reach the assessment threshold, a security assessment must be filed with the provincial CAC.
Practical steps for the foreign group
- Adopt the HR policy through the statutory procedure. Solicit employee opinion, consult the union/representatives, and publish the employee personal-information protection policy so the HR-management exemption is genuinely available.
- Map the data flows. Catalogue which HR systems sit outside China, which employee/non-employee categories are involved, and whether sensitive PI (passport, bank account, health) is transferred.
- Complete the PIPIA. Document purpose, necessity, risk and safeguards; keep the report for ≥3 years. For sensitive fields, tighten minimisation and encryption.
- Sign the cross-border data-processing agreement with the offshore parent/affiliate, aligning it with the standard-contract template’s appendices.
- Track volumes. Monitor the cumulative-from-1-January count; if it approaches 100,000 (or includes sensitive PI crossing thresholds), pivot to the formal route (assessment, certification or standard contract filed with the provincial CAC).
- Keep evidence. Retain the adopted policy, the PIPIA report, consents/notices, and the agreement — customs/court analogies aside, CAC may verify at any time.
Common mistakes
- Treating the HR-management exemption as removing the PIPIA and consent duties — it does not.
- Relying on the exemption for non-employees (candidates, contractors, dependants) without a separate lawful basis.
- Adopting the employee policy by email only, without the democratic and publicity procedure, so the exemption never validly attaches.
- Letting global HR systems auto-sync China employee data offshore without any agreement or PIPIA on file.
跨境人力资源数据与影响评估：外籍员工个人信息合规
为何此刻值得关注
跨国集团在全球化系统上运行人力资源——新加坡的薪酬平台、美国的招聘工具、欧洲的客户服务中心。对中国子公司而言，这种便利与《个人信息保护法》（PIPL）及数据出境规则相冲突：每当外籍或本地员工的记录在位于中国境外的服务器被读取或上传，即发生个人信息跨境提供。规则并非一概禁止，但施加了诸多外国 HR 团队低估的合规栈。2025 年 10 月国家网信办《数据出境安全管理政策问答》澄清了最重要的缓和——跨境人力资源管理豁免——以及标准合同备案与影响评估义务如何与之互动。本文为外商投资企业提供实操地图。
法律基线
依 PIPL（2021 年 11 月 1 日施行）及《促进和规范数据跨境流动规定》（国家网信办令 第16号，2024 年 3 月施行），确需向境外提供个人信息的处理者须满足以下之一：
- 国家网信部门组织的安全评估；
- 专业机构进行的个人信息保护认证；或
- 与境外接收方订立的标准合同，并向省级网信部门备案。
此外，PIPL 第 38 条要求处理者采取必要措施，使境外接收方按 PIPL 标准处理数据；第 39 条要求取得单独同意并事先告知个人（接收方名称/联系方式、目的、方式、数据类型及个人行权方式）。
人力资源管理豁免
2024 年规定与 2025 年网信办问答确认一项关键豁免：处理者按照依法制定的劳动规章制度和依法签订的集体合同实施跨境人力资源管理、确需向境外提供员工个人信息的，免予安全评估、标准合同与认证。
须同时满足两条件：
- 跨境提供须为实施人力资源管理所必需——问答指出其涵盖日常人事与常规业务管理场景：入职提交、薪酬福利管理、绩效评估与内部合规流转。
- 基础须为经法定民主与公示程序（征求员工意见、与工会/员工代表协商、向全体员工公示）制定的劳动规章制度或集体合同。问答强调企业应经此程序制定或本地化员工隐私/个人信息保护政策，使豁免真正可用。
第二项基于数量的豁免亦有助益：非关键信息基础设施运营者自当年 1 月 1 日起累计向境外提供不满 10 万人个人信息（不含敏感个人信息）的，免予申报。非员工（候选人、承包商、家属）通常不在人力资源管理豁免范围内，可改依该不满 10 万人门槛或正式路径。
影响评估未被免除
关键的是，豁免移除的是*机制*（评估/合同/认证），而非周边义务。2025 年问答重申，即便适用人力资源管理或数量豁免，处理者仍须：
- 在提供前开展个人信息保护影响评估（PIPIA），涵盖（一）目的与方式之合法、正当、必要；（二）对个人权益的影响及安全风险；（三）保护措施是否充分；
- 将影响评估报告与处理记录保存至少三年；
- 取得单独同意并事先告知个人，除非另有合法基础；
- 与境外接收方（通常为境外母公司或关联公司）订立跨境数据处理协议，确保 PIPL 标准保护。
问答亦澄清标准合同实务：同一境外接收方且年度数量可合理预测的，可备案一份合同而非反复备案；若自 1 月 1 日累计出境达到评估门槛，须向省级网信办申报安全评估。
外国集团的实操步骤
- 经法定程序制定 HR 政策。征求员工意见、与工会/代表协商并公示员工个人信息保护政策，使人力资源管理豁免真正可用。
- 梳理数据流。编目哪些 HR 系统位于中国境外、涉及哪些员工/非员工类别，以及是否传输敏感个人信息（护照、银行账户、健康）。
- 完成 PIPIA。记录目的、必要性、风险与保护措施；报告保存 ≥3 年。对敏感字段强化最小化与加密。
- 与境外母公司/关联公司签署跨境数据处理协议，并与标准合同范本附录对齐。
- 追踪数量。监控自 1 月 1 日起累计计数；若接近 10 万人（或含敏感个人信息跨阈值），转向正式路径（评估、认证或向省级网信办备案的标准合同）。
- 留存证据。保存已制定政策、PIPIA 报告、同意/告知及协议——网信办可随时核查。
常见错误
- 把人力资源管理豁免视为免除了 PIPIA 与同意义务——实则未免。
- 对非员工（候选人、承包商、家属）依赖该豁免而无独立合法基础。
- 仅以邮件制定员工政策，未经民主与公示程序，致豁免从未有效附着。
- 让全球 HR 系统自动将中国员工数据同步出境，而无任何协议或留存的影响评估。
Sources
- 国家互联网信息办公室《数据出境安全管理政策问答（2025 年 10 月）》：https://www.cac.gov.cn/2025-10/31/c_1763633376984070.htm
- 中华人民共和国个人信息保护法（全文）：https://jxj.hangzhou.gov.cn/art/2021/11/2/art_1229265403_3957973.html
- 促进和规范数据跨境流动规定（国家网信办令 第16号，2024 年 3 月施行）：https://www.cac.gov.cn/2025-10/31/c_1763633376984070.htm