Does this affect us if we have no office in China?

It can, because scope can follow the people whose data is being handled rather than where the handling happens. A business with customers or staff there is worth checking, and the check is about what material exists rather than about corporate structure.

What is the practical question for an AI tool?

Where the tool processes material, and what the vendor will commit to in writing about that. Most widely used tools process outside China, which turns ordinary use into cross-border handling, and that is the specific point where the regime becomes concrete rather than theoretical.

Is a self-hosted tool the usual answer?

It is one answer and it moves the work rather than removing it. Keeping processing inside a border addresses the transfer question directly and hands the organisation the operational responsibility a vendor was previously carrying, which is a real trade rather than a free one.

Glossary

PIPLpersonal information protection law

China's national data-protection law, which reaches organisations handling the personal data of people in China wherever those organisations are based.

In plain terms

China's equivalent of the data-protection rules most businesses already know something about. The part that surprises people is that it can apply to a company with no presence in China at all, on the basis of whose data is being handled rather than where the handling happens.

Why it matters

Because the question it raises about AI tools is one nobody asks until late. A business with customers or staff in China is handling material the law covers, and the tools processing that material are frequently hosted elsewhere entirely, which turns an ordinary product decision into a question about moving personal data between countries.

How it works

Its reach follows the people rather than the company. An organisation outside China that handles personal data belonging to people in China can fall within scope, which is the same extraterritorial pattern several other modern data-protection regimes use and the reason it appears in conversations at businesses with no Chinese entity.

Consent occupies a larger role than in some other regimes, and separate consent is expected for particular activities rather than being bundled once at the start. That matters for tools because processing somebody's material through a third party is exactly the kind of activity where the question of what was agreed to becomes concrete.

Moving data out of the country is the hard part rather than the incidental one. Cross-border handling carries its own requirements, and since most widely used AI tools process material outside China, the ordinary act of using one becomes the regulated act rather than a detail of it.

Enforcement sits with a national authority rather than a patchwork of regional ones, which makes the regime easier to describe and no easier to satisfy. What a business can actually assess is where a vendor processes material and what they will commit to contractually.

It is one of several national regimes a business meets at once, and that is the practical shape of the problem. An organisation operating across markets is rarely choosing which law to satisfy; it is looking for a vendor arrangement that satisfies several, which narrows the field faster than any single requirement does.

What a buyer can assess, and what they cannot

Keeping these apart is the most useful thing a glossary entry can do here, because the failure mode is specific and common: a vendor page describing regional processing options gets read as a statement that using the product is compliant, which is not a claim the vendor made or could make. Whether a regime reaches a particular organisation depends on who its customers are, what material it holds and what it does with it, none of which a vendor knows. What a vendor can tell you is where processing happens, whether it can be confined, and what they will put in a contract, and those are genuinely the things worth extracting from a sales conversation. The reason this matters more in the AI category than in most software is that the processing location is rarely incidental. A tool is useful because material goes to it and something happens to that material somewhere, so the question of where cannot be deferred to an infrastructure discussion later; it is a property of the thing being bought.

Seen in the wild

Checking where an assistant vendor processes material before staff in a Chinese office begin using it.
ChatGPT
Asking a search vendor which regions its processing can be confined to, rather than where its headquarters is.
Glean
Choosing a self-hosted deployment specifically to keep processing inside a country's borders.
Open WebUI

Common misconceptions

People assume

It only applies to companies operating in China.

In fact

Its reach can follow the people whose data is handled rather than the location of the business, so an organisation with no Chinese entity can still be handling material within scope simply by having customers or staff there.

People assume

Satisfying European rules covers it.

In fact

The regimes share a family resemblance and are not interchangeable. Consent expectations and the requirements around moving data between countries differ, so an arrangement built for one is a starting point rather than an answer for the other.

Questions

Does this affect us if we have no office in China?: It can, because scope can follow the people whose data is being handled rather than where the handling happens. A business with customers or staff there is worth checking, and the check is about what material exists rather than about corporate structure.
What is the practical question for an AI tool?: Where the tool processes material, and what the vendor will commit to in writing about that. Most widely used tools process outside China, which turns ordinary use into cross-border handling, and that is the specific point where the regime becomes concrete rather than theoretical.
Is a self-hosted tool the usual answer?: It is one answer and it moves the work rather than removing it. Keeping processing inside a border addresses the transfer question directly and hands the organisation the operational responsibility a vendor was previously carrying, which is a real trade rather than a free one.

Key takeaways

Scope can follow the people whose data is handled, not the company's location.
Moving data between countries is the requirement that usually bites.
Most widely used AI tools process outside China, making ordinary use the regulated act.
Satisfying one regime is a starting point for another, not an answer.

Tools that use this

ChatGPT
Where material is processed before a Chinese office begins using it.
Glean
Which regions processing can be confined to, not where the vendor is based.
Open WebUI
Self-hosting to keep processing inside a country's borders.

Last checked August 2026

All glossary terms