Connect to ChinaCompliance
China compliance primer
The rules on cross-border connectivity into mainland China, and the filing and data steps companies scope with their counsel. Not legal advice.
The rule: MIIT Circular [2017] No. 32
Circular [2017] No. 32, on cleaning up and regulating the internet access service market, as published, says that companies may not, without approval, set up or lease cross-border dedicated lines to run cross-border business. It was issued by the Ministry of Industry and Information Technology (MIIT). As we read it, the notice is aimed at commercial operation without the required approvals, not at every international connection a company uses. It also covers IDC, ISP and CDN licensing, resale of access resources, and lines that connect domestic and overseas data centers or business platforms to conduct telecom business.
Under the notice, basic telecommunications operators that lease international private lines are required to keep records of their users and tell them that the lines are for internal office use only. In practice the line typically has a named user, a stated internal purpose, and a carrier-side record. In our reading, it is not a general-purpose internet service that the customer can resell or use to serve third parties.
We read the notice as a compliance boundary, not a product ban. The questions it raises are who holds the line, what the line is used for, and whether the traffic is internal. A route assessment should answer those questions before it compares bandwidth, because a line that fails the use test will not be fixed by a better handoff. See the MIIT entry for the regulator's role.
Our reading of the notice: it does not create a general authorization for a private line. It sets a condition: the line must be approved where approval is required, and its use must match the internal-use statement. The carrier's record is what makes that condition visible, so the customer's description and the carrier's file need to agree.
The notice, as published by the Cyberspace Administration of China
MIIT's public statement
MIIT has said publicly, in a statement after the notice, that the clean-up targets operators without a license and that multinational companies may lease lines from basic telecommunications operators for their own internal use. Check the current MIIT text with your counsel. As we read it, the statement separates two cases that the notice can blur: an unapproved operator selling cross-border access as a business, and a company connecting its own offices. The first is the target; the second is the internal-use case that the carrier records.
In our reading, the boundary is use, not the name of the product. A line used for internal email, ERP, file sharing or management access looks different from a line used to serve customers or to resell connectivity. Document the purpose, keep it consistent with the contract, and tell the carrier when the use changes.
This page states the rule in general terms. It is not a legal opinion on your deployment, it is not legal advice, and it does not claim any compliance status for a particular route.
Keep the evidence current and complete: the contract, the line order, the stated use, the user list and the route diagram. If an auditor asks why the line exists, those documents answer before anyone has to reconstruct the story from email.
How we work
Cross-border connectivity is provided for your company's internal use. With your counsel, we help you scope the ICP filing and data-transfer steps; this is not legal advice.
Steps customers scope with their counsel
ICP filing
- Websites hosted inside mainland China need an ICP filing for each domain, made through the hosting or CDN provider. The filing is tied to the domain and the entity, and the provider usually submits it. A filing for one domain does not cover another. The ICP filing entry covers the term.
- Serving from outside mainland China, no filing applies; allow for the filing if you move hosting inside. Moving hosting later can change both the filing position and the latency your users see, so plan the migration before the content launch.
- An ICP filing is not a telecom business license. A company that wants to operate a service in China may need other approvals; the filing is only the website step.
- Keep the filing information, the domain list and the hosting contract together. They are the first documents a provider or counsel will ask for, and they make a later change of host or entity much easier to explain.
MLPS 2.0
- The Multi-Level Protection Scheme grades systems operated in China and sets the security controls each grade needs. Grading looks at the system's role, the data it handles and the harm from a failure; the grade then drives filing, assessment and the controls in GB/T 22239-2019.
- MLPS is not the same as ISO/IEC 27001 or a SOC 2 report. It is a Chinese grading and assessment scheme, and a system in scope may need a local assessment even if it holds another certification.
- Decide early which systems are in scope. A website, an order system and a factory network can have different grades, and the grade changes the design and the evidence you keep.
Personal information
- Personal information leaving China follows the Personal Information Protection Law and the data-export rules: a security assessment, a standard contract or a certification, depending on the data. The law also requires a separate consent for cross-border provision and a personal-information impact assessment for the export.
- Remote access counts. If staff outside China can query a database inside China, or if a support team can view user records, the data may be leaving even when no file is copied.
- Map the data flow before choosing a mechanism: what data, whose data, where it is stored, who can access it, and which entity receives it. The answer decides whether the assessment, the standard contract or the certification path applies. Data residency covers the storage question.
- Contract terms matter: the export mechanism has to match the role of each party, and a vendor's standard data-processing addendum may not be the required Chinese instrument. Ask counsel which agreement belongs in the file.
Not legal advice. Regulations change; check the official texts with your counsel. This is general information, not legal advice.
FAQ
Is a cross-border private line into China compliant?
Do you handle ICP filing?
Is this legal advice?
Does the MIIT notice ban all cross-border connectivity?
Is an ICP filing the same as a business license?
Does an overseas-hosted site need an ICP filing?
What counts as exporting personal information?
Is MLPS the same as ISO 27001?
Related tools
Which route fits?
Answer a few questions to compare IP transit, CloudBond, DIA/SD-WAN and IEPL/IPLC.
Open the toolChina-readiness scanner
Enter a URL to list the third-party resources on the page that may load slowly or fail in mainland China, with a fix list.
Open the toolFiber latency floor
The physical minimum round-trip time between two cities over fiber. Physics only, not our network.
Open the tool
Scope your China route with us
China circuits are quoted after a route assessment.