About China Hosting Options

OneTrust provides its Software-as-a-Service (SaaS) solutions and support to customers who operate in China. However, these services are provided from outside China, such as from the US and EEA, as OneTrust does not operate a data center or have a sales presence in China. As such, customer data is not stored in China.

OneTrust does not fall within the definition of a Network Operator, as defined by the China Cybersecurity Law (CSL), as OneTrust does not use any China-based connected networks or IT systems to operate the OneTrust platform. Under the Personal Information Protection Law (PIPL), OneTrust could be considered an 'entrusted person', i.e. an entity that provides services to its clients based in China who in turn qualify as 'personal data handlers' under PIPL. Therefore, although OneTrust is not directly required to comply with the provisions outlined in Chinese data protection and cybersecurity legislation, it can support customers in meeting their obligations, as outlined below.

Cross-Border Data Transfers

PIPL requires parties to enter into an agreement for data processing which should include the evaluation of specific safeguards in the cross-border transfer of personal data outside of China.

Furthermore, the law provides organizations with four options to lawfully transfer personal information from China to overseas destinations. These include (i) undergoing a security assessment led by the State cybersecurity and informatization department, (ii) entering into a standard contract with the recipient abroad, as issued by the State cybersecurity and informatization department, (iii) obtaining a personal information protection certification from a specialized body, or (iv) meeting other conditions set forth by laws and administrative regulations and by the national cybersecurity department.

OneTrust's existing contractual commitments are sufficient to allow any of our customers who are classified as Network Operators under the CSL, and as data handlers under the PIPL, to meet their requirements for security assessments under the current regulations.

In addition, to ensure compliance with the requirements of the PIPL towards entrusted persons in terms of information security, OneTrust has strong network security and confidentiality measures which meet the requirements outlined in the CSL and PIPL.

Notably, in March 2024 the Cyberspace Administration of China (CAC) issued the Regulations on Promoting and Regulating Cross-border Data Flows which clarify data transfer obligations under CSL, PIPL, and the Data Security Law. The Regulations provide that any outbound transfers of personal information (excluding sensitive information), by data processors that are not CIIOs, will be exempt from the requirement to conduct a data export security assessment, enter into a standard contract, and pass a personal information protection certification, if the aggregated transfer of non-sensitive personal data has not exceeded 100,000 individuals since the start of the year.

‘Separate Consent’ Requirements for Transferring Personal Information Overseas

With regard to cross-border transfers of personal information overseas from China, the PIPL requires personal information handlers (i.e. OneTrust customers operating in China) to comply with general requirements for processing personal information (e.g. consent, processing necessary for the conclusion or performance of a contract, inter alia), as well as satisfy specific requirements for transferring personal or sensitive information.

Specifically, personal information handlers transferring personal information to other handlers need to provide notice to and obtain ‘separate consent’ from the individual whose data is being transferred, unless there is another legal basis for the transfer. Such notice should include the overseas recipient's name and contact information, the purposes and means of processing, the categories of personal information to be processed, as well as the methods and procedures for the individual to exercise their rights.

Notably, in September 2024, the Guangzhou Internet Court confirmed that where there are no alternative legal bases to consent for data processing available under Article 13 of PIPL, separate consent is required for the cross-border transfer of personal information. In relation to the legal basis ‘necessary for the performance of a contract’, the Court clarified that separate consent is not required when the scope and purpose of the transfer are necessary for the business to perform its contract with the individual. However, to the extent that the scope and purpose are extended beyond what is necessary, then separate consent should be obtained in line with the principle of minimum necessity and would need to be specific, explicit, and distinct from general consent for other purposes.

Data Localization

The PIPL also explicitly refers to situations where the transfer of personal information outside of China is restricted, i.e. when one of the parties involved is a Critical Information Infrastructure Operator (CIIO), as defined within the CSL (see Appendix below), or a data handler who processes large amounts of personal information in China (Large PII Handlers) as detailed in the Appendix below. In these cases, there is an obligation to localize the data within China. The following assessment can be used to help determine the applicable obligations.

OneTrust China Hosting Options Assessment



Despite data localization obligations applicable to entities meeting the above qualification, the data can be transferred, if necessary, subject to an ad hoc security review and the fulfillment of the requirements outlined above with regards to cross-border transfers of personal information, including 'separate consent'. This is a familiar step for transferring data which predates the PIPL. For more information on the CAC guidelines for data transfers, see China: CAC issues Guidelines for Data Export Security Assessments, China: CAC issues Data Export Security Assessment Measures, and China: CAC publishes updated Guidelines on Security Assessments and Standard Contracts for Data Transfers.

For most customers, OneTrust’s security measures fit within China’s Multi-Level Protection Scheme (MLPS) for data security, so our customers can continue to transfer personal data to their OneTrust account outside of China. Finally, these same security measures are likely to be considered sufficient to pass a security review.

Cookie Consent and Universal Consent & Preference Management Options

The options available for the Cookie Consent and Universal Consent & Preference Management modules are as follows:

Note:

For more information regarding the thresholds for CIIOs and Large PII Handlers, see Appendix below.

Cookie Consent

Universal Consent & Preference Management

  • If a customer needs to localize data within the Chinese territory based on the criteria mentioned above, OneTrust supports hosting the script locally.

  • The Cookie Consent module requires certain configurations to be used to meet these requirements. OneTrust provides a Download to Local option so that the script that embeds the cookie banner & preference center onto the website can be locally hosted.

  • Additionally, customers need to turn off the feature toggle for Capture Records of Consent.

  • For more information, see Downloading and Deploying Scripts from Local Hosting and Enabling Consent Logging and the Cookie Consent Dashboard.

  • If a customer is considered a CIIO or Large PII Handler, the customer should complete a data exit security assessment as described above prior to implementing a OneTrust consent solution.

  • To provide a compliant solution, OneTrust can support two potential solutions for customers operating in China.

    For more information, see Option #1: Localized Consent Orchestration & Option #2: Segmented Consent Databases below.

    Note:

    Please note these solutions would require customers to provide storage infrastructure in China as OneTrust doesn’t operate any infrastructure within China.




Privacy Rights Automation Options

The options available for the Privacy Rights Automation module are as follows:

Option #1: Use the OneTrust web form

Using the OneTrust web form offers the benefit of faster development with only front-end work needed.



Option #2: Create your own web form

Creating your own web form offers the primary benefit of a more robust system that uses a single server to track all requests, with consent logic pushing those that consent to transfer data to OneTrust and those that do not consent to transfer data to another tool of your choice (i.e. if you have a ticketing system available in China). However, Option #2 will also require longer development along with front-end and back-end work.



China Hosting Options FAQ

The following responses are supported solutions to frequently asked questions (FAQ) on China Hosting Options. The OneTrust team continuously monitors these inquiries and will make additional FAQ available as they are identified.

Are there any issues with using the cloud-hosting solution in China?

As the cloud-hosted solution is provided from outside China, some scenarios might occur where Chinese network security systems (e.g., firewall) cause some delays in traffic and affect the overall performance of the platform. These cases should be intermittent rather than ongoing.

Alternatively, customers can also opt to operate offline. OneTrust supports an import-export feature that allows external users (e.g., a vendor receiving an assessment) to download the related template into a practical excel format. This means that, in case of latency issues that impact the ability to operate directly online, this functionality would enable, for instance, the recipient to complete an assessment offline and subsequently upload results back into the platform.

Can OneTrust's Universal Consent & Preference Management be used in China?

Customers that operate in CII industries and Large PII Handlers in China can still use OneTrust for their China operations but will be individually responsible for PIPL compliance. Customers should consider their needs based on their specific China operations and the data to be stored in OneTrust. For more information, see Cookie Consent and Universal Consent & Preference Management Options.

What are the options for the OneTrust application in China?

At this time, OneTrust does not provide the OneTrust application in China. Please refer to the options detailed above. If you would like to discuss the use of any additional OneTrust solutions, please submit a request to your OneTrust consultant.

Appendix

Qualification and requirements for Critical information infrastructure operators (CIIOs) & Data Processors processing Large Amount of Personal Information (Large PII Handlers)

CIIOs

Article 37 of the Cybersecurity Law (CSL): Regarding the personal information collected and generated from China, CIIOs must store such information in mainland China. According to Article 40 of the PIPL, CIIOs must store all the personal information collected and generated from China in mainland China, which is part of data localization obligation of the CSL.

According to Article 2 of the Regulations on the Security Protection of Critical Information Infrastructure (the Critical Infrastructure Regulations), critical information infrastructure shall refer to the important industries and fields such as public communication and information services, energy, transportation, water conservancy, finance, public services, e-government, national defense, science and technology, and other important industries and fields if they are damaged or lose their functions. An alternative criterion is where a data breach may seriously endanger important network facilities, information systems, etc. or national security, national economy and people's livelihood, and public interest.

According to Article 10 of the Critical Infrastructure Regulations, the competent authority is responsible for organizing the identification of key information infrastructure in this industry and this field in accordance with the identification rules, promptly notifying the operators of the identification results, and reporting it to the Public Security Department. Based on this, we can reasonably expect that CIIOs should be noticed by the competent authority if they meet one or more category of critical information infrastructure.

Large PII Handlers

Article 40 of the PIPL: Critical information infrastructure operators and personal information handlers handling personal information reaching quantities provided by the State cybersecurity and informatization department shall store personal information collected and produced within the borders of the People’s Republic of China domestically. Where they need to provide it abroad, they shall pass a security assessment organized by the State cybersecurity and informatization department; where laws or administrative regulations and State cybersecurity and informatization department provisions permit that security assessment is not conducted, those provisions are to be followed.

The CAC issued, on 7 July 2022, the Measures for Security Assessment of Data Exports, later supplemented by the publication of the Guidelines for Data Export Security Assessment Declaration on 31 August 2022.

In terms of Article 4 of the Measures for Security Assessment of Data Exports, when a data processor provides data overseas and falls under any of the following circumstances, it shall submit a data exit security assessment to the CAC through the local cybersecurity and informatization department:

  • the data processor provides important data overseas;

  • critical information infrastructure operators and data processors that process personal information of more than 1 million people provide personal information overseas;

  • data processors who have provided personal information of 100,000 people or sensitive personal information of 10,000 people abroad since January 1 of the previous year have provided personal information overseas; or

  • other circumstances where the CAC requires a data exit security assessment.

Additional Resources

To learn more about the PIPL’s requirements around data localization and transfers, see the following DataGuidance® Research and OneTrust Insight and News articles: