Data flows in this corridor are regulated at both ends. China restricts the export of personal information and important data through a security assessment, a standard contract filing or a certification route, with volume thresholds and special treatment for sensitive information. India has a new data protection law, the Digital Personal Data Protection Act, 2023, whose Rules were notified on 13 November 2025 with main duties from 13 May 2027, and it has blocked many Chinese-linked apps under the IT Act. A Chinese group running Indian operations needs a clear map of what data crosses the border in each direction and on what legal basis.
← Back to the complete guide: How to Set Up a Subsidiary in India from China
Key facts
| Chinese law | Personal Information Protection Law, Data Security Law and Cybersecurity Law; supervised by the Cyberspace Administration of China |
|---|---|
| Export of personal information from China | Security assessment, standard contract filing or certification, depending on the type and volume of data |
| Certification route | Measures for certification of cross-border transfers of personal information take effect 1 January 2026; certification valid for three years |
| Thresholds (as reported) | Non-sensitive data of fewer than 100,000 individuals in a year can fall within an exemption; 100,000 to 1 million via certification or standard contract; 1 million or more, or 10,000 or more sensitive records, via security assessment; important data via security assessment |
| Employee data | Treated carefully; transfers for human resources management are subject to the rules and to the exemptions in the current regulations |
| Indian law | Digital Personal Data Protection Act, 2023; Rules notified 13 November 2025; main duties from 13 May 2027; penalties up to INR 250 crore |
| Indian restrictions | Section 69A IT Act blocking of apps; government procurement and security reviews |
| Action | Map data flows both ways and decide which route applies before data moves |
China: sending data out
- Personal information: a transfer of personal information from China to a recipient abroad, including viewing it remotely from India, needs one of the three routes unless an exemption applies.
- Security assessment: run by the Cyberspace Administration, for large volumes, sensitive information above the threshold, important data and operators of critical information infrastructure.
- Standard contract filing: a standard contract with the overseas recipient, filed with the provincial authority, for smaller volumes.
- Certification: issued by approved institutions, valid for three years, suited to regular transfers. The measures take effect 1 January 2026.
- Consent and assessment: separate individual consent and a personal information protection impact assessment are normally required.
- Important data: sector rules define it; data classed as important needs a security assessment before export.
- Thresholds are cumulative from 1 January each year and splitting transfers to stay under a limit is not allowed. Confirm all figures with Chinese counsel.
India: the DPDP Act and Rules
- Who is covered: processing of digital personal data within India, and outside India if connected to offering goods or services in India.
- Notice and consent: clear notice and free, specific consent for most processing, with listed legitimate uses such as employment purposes.
- Data fiduciary duties: security safeguards, breach notice to the Data Protection Board and to affected people, erasure when the purpose ends.
- Significant data fiduciaries: larger or riskier processors face extra duties, including an audit and an impact assessment.
- Cross-border transfers: allowed except to countries the government restricts by notification. Check the notification list from time to time.
- Timeline: the Rules were notified on 13 November 2025 and the main obligations take effect on 13 May 2027.
A comparison
| Topic | China (PIPL system) | India (DPDP Act) |
|---|---|---|
| Scope | Personal information of individuals, with extraterritorial reach | Digital personal data and non-digital data that is digitised |
| Grounds | Consent and listed other grounds | Consent and listed legitimate uses |
| Cross-border | Security assessment, standard contract or certification, with exemptions | Allowed unless the destination is restricted by notification |
| Regulator | Cyberspace Administration of China and sector regulators | Data Protection Board of India |
| Maximum penalty | Up to 5% of prior-year turnover or CNY 50 million for serious violations (confirm) | Up to INR 250 crore per breach category |
Security and trust issues specific to this corridor
- India has blocked many Chinese apps under Section 69A of the IT Act and reviews telecom and critical-infrastructure suppliers closely. A Chinese-owned Indian company that handles Indian user data should expect questions about where the data is stored and who can access it.
- Store Indian customer data in India or in a jurisdiction your customers accept, and limit access from China to what is needed and documented.
- Government and regulated customers may contractually prohibit access from certain countries.
- Keep the data map and access logs ready for audits and customer questionnaires.
A build plan for one privacy programme
- Map what personal data moves between China and India and why: employee, customer, supplier and device data.
- Decide the Chinese export route for each flow and prepare consent and impact assessments.
- Document the legal basis and storage location for Indian data.
- Choose a breach response procedure that satisfies both regulators.
- Update notices and consent flows for Indian individuals before 13 May 2027.
- Train both teams and test the process.
Official sources
Check the rules at the primary sources: Income Tax Department (India), Reserve Bank of India, Ministry of Corporate Affairs, MOFCOM (China), SAFE (China) and the Ministry of External Affairs (India).
Frequently asked questions
Can a Chinese company send personal data from China to its Indian subsidiary?
Only through an approved route unless an exemption applies: a security assessment, a standard contract filing or certification, depending on the type and volume of data.
Does remote access from India count as an export from China?
Generally yes. Access from outside China to data held in China is treated as a transfer, so a route is needed.
When do India's DPDP duties start?
The Rules were notified on 13 November 2025 and the main duties take effect on 13 May 2027.
What is the penalty under the DPDP Act?
Up to INR 250 crore for serious failures such as inadequate security safeguards.
Can Indian user data be accessed from China?
Legally it can be, subject to the DPDP Act and any customer or sector restrictions, but access is a security concern in India and may be restricted by contract or regulation. Limit and document it.
Do Indian app blocks affect a new Chinese-owned company?
Blocks apply to listed apps. A new company is not blocked automatically, but data and security reviews can be strict, so be ready to explain the data location and access.
Are the Chinese transfer thresholds fixed?
No. They are cumulative from 1 January each year and the regulations have changed, so confirm the current figures with Chinese counsel.
Related guides
Hiring in India as a Chinese Employer: Local Contracts, Statutory Benefits and Managing Mixed Teams
A guide for Chinese HR teams hiring in India: written contracts, provident fund, ESI, gratuity, labour codes, notice and termination, working hours, grievance rules and the practical issues of managing a mixed Indian and Chinese team.
Read the guide →What Else Applies to Chinese-Linked Companies in India: Sector Limits, Government Contracts, App Blocks, Customs and Trade Remedies
Beyond Press Note 3: sector limits, the registration rule for land-border-country bidders in government procurement, blocked apps and security reviews, customs duty, anti-dumping duties and enforcement scrutiny for a Chinese-owned company in India.
Read the guide →Contracts, Courts and Arbitration: Choosing Law and Seat and Enforcing Awards and Judgments Between China and India
How a Chinese parent protects its Indian subsidiary contracts: choice of law and seat, CIETAC, HKIAC and SIAC arbitration, enforcement of awards under the New York Convention, judgments, stamping and the investment protection position.
Read the guide →Common Mistakes Chinese Companies Make in India and How to Avoid Them
The most frequent mistakes Chinese companies make when setting up in India: investing before Press Note 3 approval, assuming an apostille works, hidden ownership, late FEMA filings, visa mismatches and weak records.
Read the guide →Sources
Last updated 26 October 2026. General information only, not legal or tax advice. Indian and Chinese rules change often; confirm current requirements before acting.