How a Japanese Trading Firm Conducted a DPIA for Cross-Border Data in China: Case Study
In March 2024, a Japanese general trading firm (综合商社, sōgō shōsha) with 2,800 employees in China initiated a Data Protection Impact Assessment (DPIA; 数据保护影响评估, shùjù bǎohù yǐngxiǎng pínggū) for cross-border human resources data transfers. The risk-based exercise covered 12,150 individual records (employees, dependents, and contractors) and took 14 weeks to complete, requiring coordination between Tokyo headquarters, five Chinese subsidiaries, and external legal counsel. This case study details the firm’s step-by-step DPIA methodology, key findings, and operational fixes that allowed it to meet China’s cross-border data transfer requirements under the Personal Information Protection Law (个人信息保护法, PIPL, gèrén xìnxī bǎohù fǎ).
Background: The Compliance Trigger
The firm’s data compliance journey began in December 2022 when Shanghai’s cyberspace administration office (网信办, wǎngxìn bàn) issued a routine inquiry regarding the company’s HR data flows to its Tokyo parent. At that point, the firm had been transferring Chinese employee data—including salary, medical insurance claims, and performance reviews—to Japan’s global payroll system via a VPN tunnel since 2018. The total annual data volume was approximately 14.6 GB, and the firm had not conducted any formal risk assessment prior to the inquiry.
Two key regulatory triggers mandated the DPIA. First, the Cross-Border Data Transfer Security Assessment Measures (数据出境安全评估办法, shùjù chūjìng ānquán pínggū bànfǎ) published in September 2022 required a DPIA for any transfer of “important data” or personal information exceeding 1 million individuals. Second, the PIPL’s Article 38 explicitly requires a DPIA for cross-border transfers that involve sensitive personal information (SPI; 敏感个人信息, mǐngǎn gèrén xìnxī). The firm’s HR data included health insurance records (SPI), making a DPIA mandatory regardless of volume thresholds.
DPIA Operating Procedure: A Phase-by-Phase Breakdown
Phase 1: Data Mapping and Classification (Weeks 1–4)
The firm’s legal team, supported by a Beijing-based data compliance consultancy, conducted a full data mapping exercise across all five Chinese subsidiaries (Shanghai HQ, Beijing, Guangzhou, Shenzhen, Tianjin). The team discovered 36 data systems that touched employee information, including internal HR SaaS platforms, offline Excel payroll logs, third-party health insurance portals, and employee WeChat groups used for announcements. The volume of identified data elements reached 284 fields per employee record, of which 53 fields were classified as SPI (medical data, biometric time-clock records, union membership status).
A critical finding during this phase: the Tianjin subsidiary had been storing employee fingerprint templates in a separate local database since 2019 without encryption—this affected 1,240 workers and had never been disclosed to the data protection officer (DPO).
Phase 2: Risk Identification and Stakeholder Interviews (Weeks 5–8)
The DPIA team conducted 18 structured interviews with system owners, HR directors, IT security managers, and third-party vendors. Each interview followed a 42-question checklist covering data storage location, encryption standards, access control logs, retention periods, and breach response procedures. The risk scoring framework assigned a rating from 1 (low) to 5 (critical) across three dimensions: likelihood of unauthorized access, impact on individual rights, and regulatory exposure.
Risk registration results were sobering. The highest-scoring risk (score 4.7) was the absence of a data localization agreement with the Tokyo parent. Under Article 10 of the Cross-Border Data Transfer Security Assessment Measures, the foreign recipient must sign a legally binding contract specifying data protection obligations. The firm had been relying on a generic 2017 inter-company data sharing MOU that contained no China-specific terms.
| Data Category | Risk Score | Main Risk Factor | Mitigation Action |
|---|---|---|---|
| Medical insurance records (SPI) | 4.7 | No binding contract with Japan recipient | Sign standard contract clauses (SCC) under China’s SCC framework |
| Fingerprint templates (SPI) | 4.5 | Unencrypted local storage, no audit trail | Rewrite biometric policy; encrypt at rest; limit to 2-year retention |
| Salary & employment history | 3.2 | Cross-border VPN not logged for 90 days | Implement SIEM logging; retain logs for 6 months minimum |
| Employee WeChat group data | 3.8 | No consent for sharing overseas | Migrate to licensed collaboration tool; obtain separate consent |
| Third-party insurance vendor access | 2.9 | Vendor DPA lacks China-specific terms | Update data processing agreement per PIPL Article 21 |
Phase 3: Mitigation Design and Implementation (Weeks 9–13)
Based on the risk register, the DPIA team prioritized six critical mitigations to bring risk scores below 2.5 before the compliance deadline. The most impactful fix was rewriting the cross-border data transfer agreement. The firm’s legal counsel in Shanghai drafted a 18-clause SCC that incorporated China’s specific requirements: data retention limits (3 years after employment termination), individual rights procedures (access, correction, deletion requests within 15 working days), and mandatory breach notification to the local cyberspace administration office (网信办) within 48 hours. The Tokyo parent signed this agreement on March 29, 2024—the same day the DPIA final report was submitted to the Shanghai cyberspace office.
Another significant operational change involved the biometric fingerprint data. The firm replaced its legacy fingerprint scanner system (installed in 2018) with a contactless facial recognition solution that processed biometric templates only on-device and never transmitted raw biometric data overseas. This change cost the firm RMB 340,000 for hardware and software across all five offices, but eliminated the highest-volume SPI data flow.
The DPIA team also implemented a granular consent management system. Previously, all employees signed a single consent form at onboarding that covered “data processing for HR purposes.” The new system used a two-layer consent process: Layer 1 for basic personal data (name, department, salary), and Layer 2 for SPI (medical insurance, biometrics, union data). Employees received a WeChat mini-program notification with a 5-minute explainer video and could revoke Layer 2 consent at any time without employment consequences—a key requirement under PIPL Article 16.
Results and Compliance Landscape Comparison
The final DPIA report, totaling 47 pages, was submitted to the Shanghai cyberspace administration office on April 12, 2024. The office acknowledged receipt and closed the compliance inquiry without further escalation. The firm’s risk score dropped from a baseline average of 3.6 to a post-mitigation average of 1.9. None of the 36 data systems scored above 2.5 after mitigations were applied.
Comparing this timeline to industry benchmarks provides useful context. In a 2023 study by the China Academy of Information and Communications Technology (CAICT), the average DPIA for a midsize multinational took 19 weeks and cost RMB 680,000 in consulting fees. This firm completed the DPIA in 14 weeks at a cost of RMB 520,000 (including all external legal, consultancy, and system upgrade costs). The faster timeline was attributed to the decision to use China’s SCC framework rather than applying for a full-scale security assessment, which would have added 8–12 weeks and required approval from the National Cyberspace Administration (国家网信办, guójiā wǎngxìn bàn).
The comparison between SCC and security assessment becomes a key decision point. If a foreign firm processes less than 1 million individual records and does not handle “important data” as defined by the 2022 Data Security Law (数据安全法, shùjù ānquán fǎ), the SCC route is typically faster and less costly. If the data volume exceeds the threshold or includes important data (e.g., manufacturing trade secrets, infrastructure-related data), the security assessment remains mandatory.
Seven months after the DPIA submission, the firm completed its first quarterly review and found zero compliance incidents. Employee consent revocation rate for Layer 2 data was only 3.2%—indicating that transparency and ease of revocation did not materially disrupt HR operations.
3 Critical Pitfalls (and How to Avoid Them)
Decision Framework: Which Cross-Border Transfer Mechanism to Choose
If your firm transfers less than 1 million individual records per year and does not handle important data (e.g., infrastructure, national security-related trade data), choose the Standard Contract Clauses (SCC; 标准合同条款, biāozhǔn hétóng tiáokuǎn) route. This requires a DPIA and SCC filing with the local cyberspace office—typically 12–16 weeks total. If your firm transfers more than 1 million records, handles important data, or is a critical information infrastructure operator (CIIO; 关键信息基础设施运营者, guānjiàn xìnxī jīchǔ shèshī yùnyíng zhě), choose the security assessment (安全评估, ānquán pínggū) route. The assessment adds 8–12 weeks and stricter government oversight, but provides a fixed compliance period (2 years) with possibility of renewal. If your firm transfers sensitive personal information (SPI) only in small volumes (under 10,000 records) and has a legitimate data localization alternative, localize the data entirely—the PIPL allows exemption from cross-border assessment machinery if data stays in China.
NEXT STEPS
- Conduct a data mapping pre-audit using our Cross-Border Data Mapping Checklist to identify all SPI fields and foreign recipient systems before starting the DPIA—this alone can cut 4 weeks from the assessment timeline.
- Choose your transfer mechanism early by reviewing our SCC vs. Security Assessment FAQ which compares costs, timelines, and redocumentation requirements for both paths.
- Set up employee consent automation with our PIPL Consent Mini-Program Template, a ready-to-deploy WeChat mini-program that handles two-layer consent, revocation logs, and quarterly audit reports.
— China Gateway 360 —
Remote China market entry support, built around execution.
