A German subsidiary and a Chinese parent company exchange data every day: emails, orders, personnel files, engineering data, accounting records. Each direction is governed by different law. Data flowing from the EU to China is governed by the EU General Data Protection Regulation (GDPR). Data flowing from China to the EU is governed by China's Personal Information Protection Law (PIPL) together with the rules of the Cyberspace Administration of China (CAC). For accounting data, German tax law applies on top. This article sets out the rules and an architecture that satisfies all three.
Germany → China: Chapter V of the GDPR
The GDPR applies to personal data, meaning anything that relates to a person: names, email addresses, salaries, customer contacts. Pure machine or engineering data with no link to a person is not covered. For transfers to countries outside the EU, one principle applies:
“Any transfer of personal data which are undergoing processing or are intended for processing after transfer to a third country or to an international organisation shall take place only if […] the conditions laid down in this Chapter are complied with by the controller and processor …”
Art. 44 sentence 1 GDPR
The simplest route would be an adequacy decision by the European Commission (Art. 45 GDPR). There is none for China. The Commission's list includes Japan, the Republic of Korea, the United Kingdom and the USA (for certified companies), among others, but not China. Every transfer therefore needs “appropriate safeguards” under Art. 46 GDPR. In practice, these are almost always the Commission's Standard Contractual Clauses of 4 June 2021, a ready-made model contract between data exporter and data importer. Alternatively, groups can have binding corporate rules approved. The derogations in Art. 49 GDPR, such as explicit consent, cover only individual cases, not ongoing group operations.
The transfer impact assessment
The contract alone is not enough. Clause 14 of the Standard Contractual Clauses requires both parties to assess the law and practice in the destination country, including access by public authorities. The parties must document this assessment and provide it to the supervisory authority on request. In the jargon, this assessment is called a TIA, or transfer impact assessment. The European Data Protection Board (EDPB) describes six steps for it, from mapping the data flows to regular reassessment. Two points surprise many groups:
- Even remote access from a third country, for example for support, counts as a transfer.
- A legal study commissioned by the EDPB in 2021 concludes that government access to personal data in China is not effectively limited. The study does not reflect the EDPB's official position. It does, however, show which risks an assessment has to cover.
The consequence: transfers to China require additional technical measures. The most effective are encryption with keys that remain in the EU, pseudonymisation and data minimisation. Breaches of the transfer rules can be fined up to €20 million or 4% of worldwide annual turnover (Art. 83 Abs. 5 GDPR).
China → Germany: PIPL and the 2024 relaxations
For transferring personal information abroad, Chinese law generally requires one of three bases: a security assessment by the CAC, a certification or a standard contract based on the Chinese template (Art. 38 PIPL). In addition, the individuals concerned must be informed and give separate consent (Art. 39 PIPL). The CAC significantly relaxed these rules with the “Provisions on Promoting and Regulating Cross-Border Data Flows” of 22 March 2024. Key points for industrial groups:
| Situation | Consequence under the 2024 CAC provisions |
|---|---|
| Data from international trade, cross-border manufacturing or marketing without personal or “important” data | No security assessment, no standard contract, no certification (Art. 3) |
| Necessary for a contract with the individual or for cross-border HR management | Exempt (Art. 5) |
| Fewer than 100,000 individuals per calendar year, no sensitive data | Exempt, except for critical information infrastructure operators (Art. 5) |
| 100,000 to under 1 million individuals, or under 10,000 individuals with sensitive data | Standard contract or certification (Art. 8) |
| 1 million individuals or more, 10,000 or more individuals with sensitive data, or “important data” | Security assessment by the CAC (Art. 7) |
A company only has to declare “important data” as such if the authorities have notified it or publicly classified the data that way (Art. 2). Information and consent obligations remain even where exemptions apply (Art. 10). Since 1 January 2026, implementing rules for certification have also been in force; the certificate is valid for three years, and data volumes may not be split artificially. We cite the Chinese provisions from the official Chinese text published by the CAC; the English wording is our own translation.
In practice for group IT: email, ERP, cloud
- Email: A shared mailbox system with storage in China turns every email containing personal data into a transfer. A better approach is a separate tenant for the German company with storage in the EU and a controlled connection to the group.
- ERP: The statutory bookkeeping of the German GmbH stays in Germany. Headquarters receives key figures and totals via a mapping. What that looks like is described in our article Understand Your German Subsidiary in 15 Minutes.
- Cloud and administration: Storage region and administrator rights belong in the contract. An administrator in China who accesses EU data triggers the transfer rules.
- Personnel data: From China to the EU, often exempt under Art. 5 of the CAC provisions; from the EU to China, only with Standard Contractual Clauses and a documented assessment.
“The cleanest architecture is usually the simplest: personal data from Germany stays in the EU, and headquarters sees key figures. Whatever still has to go to China runs on Standard Contractual Clauses, a documented assessment and keys held in Europe.”
Metehan Kurt, IT consultant · DAVINCI Rechenzentrum
Tax data: the books stay in Germany or need approval
For accounting data, the German Fiscal Code (Abgabenordnung, AO) also applies. Books must, as a rule, be kept and stored in Germany (§ 146 Abs. 2 AO). In another EU member state, this is permitted without an application (§ 146 Abs. 2a AO). In a third country such as China, only with the tax office's approval, and only if the tax office retains full data access (§ 146 Abs. 2b AO). Data access is governed by § 147 Abs. 6 AO.
This is where legal systems can collide. Under Art. 41 PIPL, personal information stored in China may not be provided to foreign judicial or law enforcement authorities without the approval of the Chinese authorities. Whether this affects a German tax audit in a given case is a legal question for lawyers in both countries. We plan so that it never arises: the books stay in Germany.
Suppose a Chinese investor has acquired a German automotive supplier and relocated parts of production. Engineering drawings with no link to individuals are not covered by the GDPR. The contact details of German customers and the personnel files of the German workforce are. The bookkeeping stays in DATEV in Germany, and headquarters receives the key figures.
This architecture is part of our combined approach to structure, bookkeeping and IT. The tax side is the responsibility of our partner tax firm TABAK Steuerberatung. We do not provide legal advice on Chinese law; for that, we work with law firms on the ground.
We advise you in English — directly, without intermediaries.
Frequently Asked Questions
Is China a “safe third country” under the GDPR?
No. The European Commission has not adopted an adequacy decision for China. Transfers require appropriate safeguards under Art. 46 GDPR, usually Standard Contractual Clauses.
Are the Standard Contractual Clauses enough on their own?
No. Clause 14 requires a documented assessment of the law in the destination country. Depending on the outcome, additional measures are needed, such as encryption with keys held in the EU.
Do we need CAC approval for personnel data from China?
Often not. Cross-border HR management based on lawful employment rules is exempt under Art. 5 of the 2024 CAC provisions. Informing employees and obtaining their consent remains mandatory, however.
Is remote maintenance from China a data transfer?
Yes, if personal data from the EU becomes visible in the process. The EDPB also classifies remote access from a third country as a transfer.
May we mirror the DATEV bookkeeping in China?
Key figures and totals, yes, within the limits of the GDPR. The books themselves may only be kept in a third country with the tax office's approval (§ 146 Abs. 2b AO).
Sources
- Regulation (EU) 2016/679 (GDPR), Art. 44–49, 83
- Implementing Decision (EU) 2021/914 – Standard Contractual Clauses
- European Commission: adequacy decisions
- EDPB: Recommendations 01/2020 (Version 2.0)
- EDPB: Legal study on government access to data in third countries (2021)
- CAC: Personal Information Protection Law of the PRC (PIPL), in Chinese
- CAC: Provisions on Promoting and Regulating Cross-Border Data Flows (2024), in Chinese
- CAC: Announcement on certification for data exports (2025), in Chinese
- § 146 AO – place of bookkeeping
- § 147 AO – retention, data access
Bring order to your data flows between China and Germany.
We map your data flows, plan storage locations, access and encryption, and coordinate the accounting side with our partner tax firm TABAK Steuerberatung.