European companies meet Chinese data law in one of two ways: they read something alarming and freeze, or they assume that having no Chinese entity puts them outside it. Both are wrong, and the second is the expensive one.
It reaches outside China
The law applies to processing carried out outside China when the purpose is to offer products or services to people located in China, or to analyse their behaviour. A French company running a WeChat account that collects leads, or a site that takes orders from Chinese customers, is inside its scope. In that situation the law also requires designating an entity or representative in China and filing their details with the authority.
Consent is not the European consent
Where you rely on consent it must be explicit and granular, with no pre-ticked boxes. Two situations require a separate and specific consent, distinct from the general one: sensitive personal information, and any transfer of data out of China. A single global acceptance does not cover either. This is the most common gap in a European company's Chinese setup, because the European template was reused.
Getting data out of China
Three mechanisms exist: a security assessment by the regulator, a filed standard contract, or certification by an accredited body. Which one you need depends on volume, on whether sensitive data is involved, and on whether the data is classified as important. Thresholds are counted in numbers of individuals and they are revised, so have the current ones confirmed rather than relying on a figure from an article.
What genuinely helps is knowing that exemptions exist. Transfers necessary to perform a contract to which the individual is a party — a booking, a delivery, a payment — and human resources management conducted under documented internal rules are treated differently. A great many European companies in China are doing nothing more than these two things and are budgeting for a full assessment they do not need.
No exemption covers data classified as important. If that is in play, the assessment route is the only one.
Data localisation is not a general obligation in China. It applies to critical information infrastructure operators and above defined thresholds. A mid-sized European company with a WeChat account and a customer list is almost never in that position — and is routinely told otherwise by vendors selling local hosting.
Where to read it yourself
Official pages, opened and checked on 15 October 2026. Where a rule changes, these are the addresses that change with it — this article does not.