Selling SaaS to Chinese companies from servers abroad

China licenses or records internet services provided within its borders, and only a company set up in China holds the licence. A SaaS served from abroad therefore has nothing to file. The rules that bite are your Chinese customer’s: sending personal information abroad takes consent, an impact assessment and, past set volumes, a standard contract or CAC assessment.

A company in Shanghai wants to subscribe to your software. Your servers are in Frankfurt or Virginia, you have no entity in China, and the customer’s IT team has sent a questionnaire asking for your ICP number and where its data will be stored. The first question has a short answer. The second decides whether the customer can sign, because under Chinese law the party sending the data abroad is the customer, not you.

Does a SaaS hosted outside China need an ICP licence?

The ICP rules neither require one nor offer one. China licenses paid internet information services through the ICP licence (经营许可证) and records free ones through the ICP filing (备案). Both rules are written for services provided within China.^⁠[1,2] The filing is made through the Chinese data centre or access provider that connects the site, and that provider may not connect a service that has neither.^⁠[2,3]

The licence itself goes only to a company set up in China. A foreign-invested telecoms company is one a foreign investor establishes inside China, and it applies for the licence after it is registered.^⁠[3,4] Outside four pilot areas, the foreign share in most value-added telecoms services is capped at 50%.^⁠[5,6]

The silence cuts both ways. The texts do not say that a service hosted abroad is lawful in China; they do not deal with it at all. In July 2026 China’s internet regulator proposed a rule for services provided into China from abroad, covered in the last section.

Route	What the rules ask for	Who holds it
Serve from servers abroad	No ICP licence or filing exists for a server outside China	Nobody
Host in China境内接入	An ICP licence or filing before the Chinese access provider connects the service	The operator of the service, through the access provider
Your own Chinese company	A value-added telecoms licence after registration; registered capital of RMB 1 million for one province or RMB 10 million nationwide	A company established in China, foreign share capped at 50% outside the pilot areas

Who is exporting the data, us or our customer?

Your customer. The Personal Information Protection Law (个人信息保护法) puts the duties on the processor that provides personal information outside China.^⁠[7] A Chinese company uploading its records to your servers abroad is that processor. Whatever the volume, the customer must tell the people concerned who receives their data abroad, obtain their separate consent and run an impact assessment first.^⁠[7,8]

Volume then decides the route, counted from 1 January each year. The figures below apply to a customer that is not a critical information infrastructure operator; one that is goes to a CAC security assessment for any personal information.^⁠[8]

People whose data goes abroad in a year	What your customer needs
Fewer than 100,000, no sensitive information	No contract filing or assessment; notice, separate consent and the impact assessment still apply
100,000 to 999,999, or fewer than 10,000 with sensitive information	A standard contract with you, filed with the provincial cyberspace office within 10 working days of taking effect, or certification
1,000,000 or more, or 10,000 or more with sensitive information, or any important data	A CAC security assessment

Two narrower exemptions apply alongside the volume test: data needed to conclude or perform a contract with the individual, and employee data needed for cross-border HR management under lawful labour rules.^⁠[8] Whether ID numbers, passports and bank accounts fall within the HR exemption is judged case by case, the CAC said in October 2025.^⁠[10]

Hosting in China does not end the question. Data kept in China counts as leaving it when someone outside China accesses or retrieves it, so a support engineer in Lisbon who logs into a customer’s China-hosted records counts as an export. A foreign company’s staff reading the data inside China, without sending it abroad, do not.^⁠[10]

What does that look like for one customer?

Say a Shanghai retailer subscribes on 1 March 2027 to a Dutch CRM hosted in Frankfurt and uploads 40,000 customers’ names and phone numbers. That is fewer than 100,000 people and no sensitive information, so the retailer needs neither a standard contract nor an assessment. It still owes notice, separate consent and the impact assessment.

In July it plans to add 2,000 loyalty members’ bank account numbers for refunds. Financial account details are sensitive personal information (Personal Information Protection Law, Article 28),^⁠[7] and the volume exemption covers only data that is not sensitive. Before that upload, the retailer needs a standard contract with the Dutch company, or certification.^⁠[8] If the contract takes effect on 1 July 2027, the filing is due by 15 July, ten working days later.^⁠[9]

The Dutch company signs as the overseas recipient, on the regulator’s form. Extra terms may be added, but none may conflict with the form.^⁠[9] A vendor that can list its data fields, hosting locations and the places its support staff log in from gives the customer most of what its impact assessment asks for.

Does China’s privacy law reach the vendor directly?

It can. The law also covers processing outside China whose purpose is to provide products or services to individuals in China, or to analyse their behaviour.^⁠[7] A processor caught that way must set up a body or appoint a representative in China and report its name and contact details to the regulators (Article 53).^⁠[7] Since 1 January 2026, a foreign processor seeking certification applies through that body or representative.^⁠[11]

A consumer app with users in China fits the first limb plainly. A business tool that holds records only on its customer’s instructions is a harder case, and the law does not settle it.

Our product has AI features. Do the generative AI rules apply?

They apply to generative AI services offered to the public in China. Companies that develop and use the technology without offering it to the public are outside them.^⁠[12] Where a service provided from abroad does not comply, the CAC can have the relevant bodies take technical and other measures against it (Article 20).^⁠[12]

The Measures do not define “the public”, so whether a feature sold only to business customers is covered is unclear. The filings a public-facing AI service needs are set out in our piece on the 2026 digital trade expo.

Can our customer’s staff reach us over a VPN?

Through a line rented from a licensed operator, for internal office use. MIIT’s 2017 notice bars building or renting dedicated lines, VPNs included, to carry on cross-border business without approval. International lines that operators rent to users are for the user’s internal office use and may not link data centres or business platforms to run a telecoms business.^⁠[13]

The notice is addressed to operators and their users, so the line is your customer’s to arrange. Reliability over the public internet is a commercial point for the contract, not a licensing question.

When does a Chinese company become worth it?

When your customers want the service hosted in China, or the data kept there. Then the route runs through a licence, held by a Chinese company of your own or by a licensed partner. MIIT says 166 foreign-invested companies have been approved under the pilot since February 2025, as reported by China News Service in June 2026.^⁠[14] The ownership limits sit on the list explained in our guide to China’s negative lists, and the wider entity question in do you need a Chinese company.

Whichever route you take, the customer pays across a border and its finance team withholds tax before paying. How that works for a software fee paid abroad is in our piece on licence fees.

What is still open for foreign SaaS, as at 8 October 2026?

• A rule for services from abroad. The CAC published a draft revision of the Internet Information Services Measures on 3 July 2026, taking comments to 2 August.^⁠[15] Draft Article 92 says foreign organisations and individuals providing internet information services into China must comply with Chinese law, and draft Article 8 keeps approval for services within China. No final text or effective date has been published.
• The vendor as processor. Whether a business tool acting on its customer’s instructions is a processor the privacy law reaches from abroad, and so needs a representative in China, is not settled by the law.
• “The public” for AI features. Whether an AI feature sold to businesses is offered to the public is not defined.
• The telecoms pilot. It runs in four areas only (zones in Beijing and Shanghai, Hainan and Shenzhen), and no national rollout has been announced.^⁠[6]

A Market Entry & Structure Advisory sets the three routes side by side for one product: serving from abroad, hosting through a licensed Chinese partner, or a company of your own. It shows what each means for your customers’ data and your price.

Share on LinkedIn (opens in a new tab)

Want this done rather than explained? Market Entry & Structure Advisory From US$900, 2–3 weeks. See the service