Four problems that decide whether the deal works
Each of these comes up in ordinary commercial documents — not in exotic transactions. Each has a citation, and each has a practical fix.
Why your supplier cannot just send you the data
When a Chinese counterparty stalls on sending customer or operations data, it is usually a filing problem, not an IT problem.
- The obligation sits on the party inside China. China's Personal Information Protection Law (PIPL) sets the conditions for providing personal data outside China, and the Data Security Law and Cybersecurity Law add duties for important data and for critical information infrastructure operators. PIPL Art. 38; Data Security Law; Cybersecurity Law
- There are three mechanisms, and which one applies depends on volume and sensitivity. A security assessment organised by the regulator, filing of standard contractual clauses, or personal information export certification. Splitting a transfer into batches to stay under a threshold is treated as evasion, not compliance. Data Export Security Assessment Measures; Certification Measures
- "Just upload it to our server" is the risky ask. A request to move supply-chain, employee or customer data out on a short deadline can put your counterparty in breach of Chinese law — which is why the request is refused. PIPL; Data Security Law
Sanctions clauses: when your protection becomes their breach
A clause that lets you exit on a sanctions listing can be unenforceable against a Chinese counterparty — and demanding performance may force them to break Chinese law.
- China has its own blocking regime. The Anti-Foreign Sanctions Law and the rules counteracting the unjustified extra-territorial application of foreign legislation restrict compliance with foreign measures China regards as discriminatory. Anti-Foreign Sanctions Law Art. 12; Blocking Rules
- The counterparty ends up squeezed from both sides. Perform and they may breach Chinese law; refuse and they breach your contract. Reported disputes include suppliers suspending performance after a listing and being sued for it. Anti-Foreign Sanctions Law
- Courts may not rescue the clause. Chinese courts examine foreign-related contracts on public-policy grounds, but violation of a Chinese mandatory rule is not automatically a standalone ground — outcomes are uncertain. Civil Procedure Law; judicial practice
Export control points in both directions
Two separate regimes can bite on the same shipment — or on the same repository.
- Out of China. The Export Control Law and the dual-use items regulation control goods, software and technology leaving China. Providing source code, technical data or training to a foreign national can be a deemed export even when nothing physical ships. Export Control Law; Dual-Use Items Regulation
- Into China. The US Export Administration Regulations may restrict items going in, including certain AI model weights, with a foreign direct product rule that can attach to models fine-tuned offshore. US EAR; ECCN 4E091; FDPR
- Red flags are commercial, not technical. Requests to reroute shipping, remove model numbers or describe components vaguely matter more than any classification code. Export compliance practice
Supply chain diligence — and the data you ask for
Asking a supplier to prove clean labour practices can itself create a data problem.
- What buyers now need. Traceability and due-diligence evidence is now routine under forced-labour import rules and European supply-chain legislation. UFLPA; EU CSDDD
- The trap. Production-line data, factory coordinates and workforce records can be sensitive under Chinese law, so the evidence you request may not be lawfully transferable as raw data. Data Security Law; Surveying and Mapping Law
- The workable form. Ask for aggregated or audited evidence — third-party audit reports, certifications — rather than raw operational records. Audit practice
What a document-level check looks for
Data export path
Does a clause trigger a security assessment, standard clauses or certification — and does it try to split volume across batches?
Sanctions and exit terms
Do exit, suspension or indemnity clauses collide with Chinese blocking rules?
Export-controlled items
Does anything covered include goods, software, source code or technical data crossing a border?
Consent and marketing
Do consent, withdrawal and ad-personalisation terms satisfy PIPL, GDPR and CCPA at the same time?
Retention and localisation
Are retention periods stated, and does offshore storage cut against localisation duties?
Governing law and forum
Does the chosen forum leave room for mandatory Chinese rules to apply?
How to run it
- Upload the documentA contract, an NDA, a data-processing appendix or a supplier questionnaire — any PDF.
- Choose the jurisdictionsChina, the United States, the European Union, or all three at once.
- Read the findingsEach finding names the issue and cites the actual article, so you can check the source yourself.
- Fix it and exportAnnotate, edit and export the clean file in the same workspace — no round trip through another tool.
Frequently asked questions
What are the three legal paths for moving personal data out of China?
A security assessment organised by the regulator, filing of standard contractual clauses, or personal information export certification. Which one applies depends on the exporter's status, the volume of personal information, and whether important data is in scope.
Can my Chinese supplier legally send me customer data?
Only through a completed mechanism. The duty sits on the exporter inside China, so a supplier that has not filed cannot simply comply with a transfer request — doing so would expose them. In practice, build the transfer around whatever mechanism they have completed.
Are sanctions exit clauses enforceable in China?
Not reliably. China's Anti-Foreign Sanctions Law and Blocking Rules can prevent a Chinese party from complying with measures China treats as discriminatory, so a termination right tied to a foreign listing may not be enforced, and demanding performance may put the counterparty in conflict with Chinese law.
What counts as an export from China besides shipping goods?
Transfers of technology, source code, technical data, and even training or technical guidance given to a foreign national can count as a deemed export. This is what most often catches engineering and AI teams by surprise.
Which export-control rules apply to AI models?
Both directions can apply. China restricts the export of certain technologies including some algorithm categories, while the US EAR covers certain AI model weights, with a foreign direct product rule that can reach models fine-tuned outside the United States.
Is PDFnoted giving legal advice?
No. It produces a document-level risk report that cites the actual articles so you can see what to look at. It is a structured first pass, not a legal opinion — for anything you are about to sign or ship, use qualified counsel.
What does the regulation corpus actually contain?
219 regulation source files and 22,671 article-level entries across China, the United States and the European Union, including PIPL, the Data Security Law, the Export Control Law, the Anti-Foreign Sanctions Law and the Blocking Rules on the Chinese side, GDPR and the EU AI Act on the European side, and the EAR and UFLPA on the US side.
Can I check a Chinese-language contract?
Yes. Upload the original; findings are anchored to the source text so you can see which clause triggered each one, even if you read the report in English.
Check the contract before it becomes a dispute
Upload the document, pick the jurisdictions, and read findings that cite the actual articles — then fix the file in the same workspace.
Scan a documentKeep going
Sources and further reading: PIPL (Personal Information Protection Law). This page is a technical guide, not legal advice.