China payroll requires employers to process some of the most confidential information they hold about employees. A normal payroll file can contain names, identification details, salary, bank accounts, individual income tax information, social insurance records, housing fund information, medical or leave data and information about an employee’s family members.
When payroll is outsourced or consolidated into a global system, that information may also be accessed by payroll providers, HRIS vendors, finance teams, regional HR teams and overseas headquarters.
China’s Personal Information Protection Law (PIPL) applies to these processing activities. However, payroll data privacy is not simply a question of obtaining an employee consent form. Employers need to identify why each data item is collected, distinguish ordinary personal information from sensitive personal information, control vendor access, define retention periods, support employee rights and assess any cross-border access to China payroll data.
This guide focuses only on payroll and salary data. It is not a general introduction to PIPL. For the wider monthly payroll-control framework, see HROne’s China payroll compliance guide.
Key Takeaways
- Payroll data is personal information, but not every payroll field is automatically “sensitive personal information” under PIPL.
- Financial account information, medical and health information and personal information of children under 14 are among the categories receiving enhanced protection.
- Employers should identify the legal basis for each payroll-processing activity instead of relying on one blanket employee consent.
- A payroll provider may act as an entrusted processor, but the employer must still define the processing scope and supervise the provider.
- Overseas headquarters access to China payroll information can trigger cross-border data requirements even when employees are paid locally.
- The 2024 cross-border data rules provide exemptions from certain transfer mechanisms for qualifying HR-management transfers, but they do not remove underlying PIPL obligations.
- Payroll-data retention should balance statutory recordkeeping requirements with PIPL’s requirement not to retain personal information longer than necessary.
What Payroll Data Is Protected Under China’s PIPL?
PIPL defines personal information broadly as information recorded electronically or otherwise that relates to an identified or identifiable natural person, excluding anonymized information.
That means most employee-level payroll records fall within PIPL.
China’s official Personal Information Protection Law requires personal-information processing to follow principles including lawfulness, necessity, transparency, accuracy and accountability.
| Payroll data | Typical privacy classification | Main payroll use |
|---|---|---|
| Employee name and contact information | Personal information | Employee identification and payroll communication |
| ID number and identification documents | Personal information; certain identity-document information may require enhanced protection | Payroll, tax and statutory registration |
| Salary, bonus and commission | Personal information and highly confidential employment data | Payroll calculation and reporting |
| Bank account | Sensitive personal information | Salary payment |
| Tax identification and IIT records | Personal information; individual records may contain higher-risk identity or financial information | Individual income tax withholding and reporting |
| Social insurance records | Personal information; may contain identity and benefit information requiring stronger controls | Statutory contribution administration |
| Housing fund records | Personal information; account details may require enhanced protection | Housing fund administration |
| Medical certificates and medical leave records | Sensitive personal information | Leave, absence and payroll adjustment |
| Dependent and family information | Personal information; information about children under 14 is sensitive personal information | Tax deductions, benefits or employee support |
| Attendance and leave | Personal information; medical-related records can be sensitive | Payroll adjustments |
| Work permit and immigration records | Personal information that may contain sensitive identity information | Foreign-employee payroll and employment administration |
Is All Payroll Data Sensitive Personal Information?
No. This distinction is important.
Article 28 of PIPL defines sensitive personal information as information that, if leaked or illegally used, could easily harm an individual’s dignity or personal or property safety. The law specifically identifies categories including biometric information, religious beliefs, specific identity information, medical and health information, financial accounts and location tracking, as well as personal information concerning minors under 14.
The Cyberspace Administration of China’s 2026 personal-information protection guidance also identifies examples such as bank, securities, fund and insurance account information, medical records and resident identity-card photographs.
Salary itself is personal information and should be treated as confidential, but PIPL does not simply classify every salary figure as sensitive personal information solely because it is payroll data.
The practical approach is therefore to classify payroll fields individually rather than applying one label to the entire payroll database.
What Legal Basis Can Employers Use to Process Payroll Data?
Employee consent is not the only legal basis available under PIPL.
Article 13 of the Personal Information Protection Law permits personal information processing in several circumstances, including where it is necessary:
- to conclude or perform a contract to which the individual is a party;
- for human resources management under lawfully formulated labor rules and a lawfully concluded collective contract; or
- to perform statutory duties or legal obligations.
Payroll processing may rely on different bases for different activities.
| Processing activity | Possible basis to review |
|---|---|
| Using salary terms to calculate payroll | Employment contract and HR-management necessity |
| Using employee identity information for IIT | Employment administration and statutory obligation |
| Processing information for social insurance | Employment administration and statutory obligation |
| Paying salary into an employee bank account | Employment contract and payroll administration, subject to sensitive-information requirements |
| Processing medical information for leave or benefits | Requires a specific necessity analysis and sensitive-personal-information controls |
| Sending payroll data to an overseas headquarters | Requires separate cross-border analysis in addition to the underlying processing basis |
A payroll privacy notice and a consent form therefore serve different functions. Employers should not collect one broad consent at onboarding and assume that it authorizes every future payroll use, vendor disclosure or international transfer.
Sensitive Payroll Data Requires Additional Controls
PIPL applies stricter requirements to sensitive personal information.
The processing must have a specific purpose, sufficient necessity and strict protection measures. PIPL also requires separate consent for processing sensitive personal information and additional notice regarding why the processing is necessary and how it may affect the individual.
In payroll operations, this is particularly relevant to information such as:
- employee bank account information;
- medical and health information;
- certain identity documents;
- information relating to disability or other specific identities;
- financial account information used for benefits; and
- personal information relating to children under 14.
The employer should avoid exposing these fields merely because someone needs access to the payroll register.
For example, a line manager may need to approve an employee’s absence but normally does not need access to the employee’s bank account, full tax history or medical diagnosis.
Only Collect Payroll Data That Is Actually Needed
Payroll implementations often accumulate unnecessary fields because teams copy an old spreadsheet or global HR template without reviewing why each column exists.
PIPL requires personal information collection to remain within the minimum scope necessary for the processing purpose.
For every payroll field, ask:
- Why do we collect this information?
- Which payroll, tax, benefit or employment process requires it?
- Is the full data field required or would a reduced field be sufficient?
- Who needs access?
- Does the payroll provider need this information?
- Does overseas headquarters need the employee-level record or only an aggregated report?
- How long must the information remain identifiable?
Collecting information “just in case” creates unnecessary privacy exposure.
Be particularly careful with dependent information
Payroll and benefits teams may collect spouse, parent or child information for tax deductions, insurance, leave or employee-benefit administration.
This means the employer may be processing information relating to individuals who are not employees.
Where the data concerns children under 14, PIPL treats the information as sensitive personal information and applies additional requirements. Employers should therefore avoid importing complete family records into payroll when only limited information is needed for a specific deduction or benefit.
What Should a Payroll Privacy Notice Explain?
Employees should be able to understand how their payroll information is used.
Article 17 of PIPL requires personal information processors to provide clear information about matters including the processor’s identity, processing purposes and methods, categories of personal information, retention period and procedures for exercising individual rights.
The Network Data Security Management Regulations, effective from January 1, 2025, further require personal-information processing rules to be clearly presented and to explain sensitive-information processing and retention arrangements.
A payroll-specific notice should therefore explain, where applicable:
- which employee data is used for payroll;
- why each major category is needed;
- which legal entities process the information;
- whether an outsourced payroll provider receives it;
- whether HRIS, accounting or benefits providers receive it;
- which data may be accessed by overseas headquarters;
- where cross-border processing occurs;
- how long payroll records are retained;
- how employees can request access or correction; and
- how employees can raise a privacy concern.
The notice should reflect the real payroll data flow rather than a generic privacy template that does not identify vendors or international access.
Control Who Can See Employee Salary and Payroll Data
Payroll privacy depends heavily on access design.
Article 51 of PIPL requires personal information processors to establish internal procedures, classify personal information, apply appropriate security measures, define processing permissions and provide security training.
Payroll access should follow role responsibility.
| User | Typical access need | What should normally be restricted |
|---|---|---|
| Payroll processor | Employee payroll inputs and calculations | Unrelated HR or investigation records |
| HR | Employment, compensation and payroll changes | Bank-payment administration unless required |
| Finance | Payroll totals, funding and accounting | Medical details and unnecessary employee documents |
| Line manager | Approved compensation, attendance or variable-pay inputs relevant to direct reports | Full payroll register, bank details and tax records |
| Regional or global HR | Information necessary for group HR management | Complete China payroll files where aggregated or reduced data is sufficient |
| Payroll provider | Data required for the contracted payroll scope | Employee information unrelated to the service |
| IT administrator | Technical system administration | Routine visibility of payroll content unless necessary |
Shared payroll folders accessible to an entire HR or finance department are difficult to justify simply because those teams work with employee information generally.
Employers should also review privileged administrator accounts. Technical access can expose payroll data even where the administrator is not part of the payroll team.
What Is the Payroll Provider’s Responsibility Under PIPL?
Outsourcing payroll does not outsource the employer’s privacy governance.
Where a payroll provider processes personal information on the employer’s instructions, the arrangement may constitute entrusted processing under Article 21 of PIPL.
The PIPL rules on entrusted processing require the parties to agree on matters including:
- the purpose of processing;
- the processing period;
- processing methods;
- the categories of personal information involved;
- security measures;
- the parties’ rights and obligations;
- return or deletion of information after processing ends; and
- conditions for any subcontracting.
The employer must also supervise the entrusted processor’s activities.
This means a payroll outsourcing agreement should do more than say that the vendor “will comply with applicable privacy law.”
Do not assume every payroll vendor has the same PIPL role
A provider acting only on documented client instructions may have a different legal role from a provider that independently determines why or how certain information is processed for its own obligations.
The contract and privacy documentation should therefore reflect the actual data relationship rather than automatically copying terminology from a GDPR data-processing agreement.
When another independent personal information processor receives employee information, separate requirements under PIPL can apply.
What Should Employers Ask a China Payroll Provider About Data Privacy?
Before providing live employee data, employers should understand the provider’s actual data flow.
| Review area | Question for the payroll provider |
|---|---|
| Data scope | Which employee fields do you require and why? |
| Storage | Where is payroll information stored? |
| Access | Which teams and roles can access employee-level payroll data? |
| Subprocessors | Which third parties, cloud providers or affiliated entities process payroll information? |
| Cross-border access | Can personnel or systems outside mainland China access the data? |
| Security | How is payroll information protected in transit and at rest? |
| Permissions | How are privileged accounts approved and reviewed? |
| Logging | Can the provider show who viewed, changed or exported payroll information? |
| Retention | How long is payroll information retained? |
| Exit | What data is returned or deleted after the service ends? |
| Incidents | How quickly will the employer be informed of a suspected payroll-data incident? |
| Employee rights | How will the provider support access, correction or deletion requests? |
These questions are particularly important when the provider uses a global platform even though the payroll itself is processed in China.
Does Overseas Headquarters Access Count as a Cross-Border Payroll Data Issue?
Potentially, yes.
A company does not avoid cross-border privacy analysis merely because the payroll server or employee bank account is located in China. Payroll data may still be made available to recipients or users outside mainland China through global HRIS access, regional payroll consolidation, finance reporting, shared cloud systems or headquarters reporting.
Examples include:
- a US finance team downloading China employee salary data;
- a European HR team viewing individual China compensation records;
- a global payroll platform consolidating employee-level China data overseas;
- a regional benefits team receiving dependent information;
- an overseas audit team obtaining China payroll files; and
- a foreign parent company receiving tax or bank-account information.
Employers should map these access routes rather than reviewing only formal file transfers.
What Do China’s Cross-Border Data Rules Mean for Payroll?
PIPL contains specific requirements for providing personal information outside mainland China, including notice, separate consent and safeguards for the overseas recipient.
China subsequently introduced more detailed data-export mechanisms and exemptions.
The Cyberspace Administration of China’s Provisions on Promoting and Regulating Cross-Border Data Flows provide that certain employee-information transfers necessary for cross-border human-resources management may be exempt from the security-assessment, standard-contract and personal-information protection certification mechanisms where the conditions in the rules are satisfied.
The exemption is narrower than simply saying “this is HR data.” It refers to cross-border HR management carried out under lawfully formulated labor rules and a lawfully concluded collective contract.
Article 10 of the same rules also makes clear that a data processor sending personal information overseas must continue to perform applicable obligations concerning notice, separate consent and personal information protection impact assessments.
Employers should therefore separate two questions:
| Question | What must be assessed |
|---|---|
| Is the outbound payroll transfer lawful under PIPL? | Purpose, necessity, notice, consent where required, sensitive data, recipient and protection measures |
| Which formal outbound-data mechanism applies? | Security assessment, standard contract, certification or an applicable exemption under current CAC rules |
An exemption from one formal transfer mechanism does not mean the payroll data is outside PIPL.
For the broader relationship between overseas salary, global payroll and China reporting, see HROne’s cross-border payroll guide.
Does China Require All Payroll Data to Stay in China?
No blanket rule says that every employer must keep all payroll information permanently inside mainland China.
However, PIPL and China’s data-export framework can impose localization, security-assessment or transfer-mechanism requirements depending on the organization, the information involved and the volume and nature of outbound data.
Companies should therefore avoid two opposite assumptions:
- “Payroll data can never leave China”; and
- “Global HR access is internal, so cross-border rules do not apply.”
The correct analysis depends on the actual data flow, data categories, recipient, scale, whether sensitive personal information or important data is involved and whether an exemption applies.
Complete a Privacy Impact Assessment for High-Risk Payroll Processing
Article 55 of PIPL requires a personal information protection impact assessment before certain higher-risk activities.
These include:
- processing sensitive personal information;
- entrusting personal information processing to another party;
- providing personal information to another personal information processor;
- providing personal information overseas; and
- other processing activities that may have a significant impact on individual rights.
A payroll privacy impact assessment should document:
- the purpose of the processing;
- why the data is necessary;
- the payroll information involved;
- the employees or dependents affected;
- the systems and providers involved;
- access locations;
- security risks;
- potential impact on employees;
- controls used to reduce the risk; and
- why the remaining processing is proportionate.
PIPL requires the assessment report and processing record to be retained for at least three years.
How Long Can Employers Keep Payroll Data?
PIPL does not provide one universal retention period for every payroll field.
Article 19 establishes a general principle that personal information should be kept for the shortest period necessary to achieve the processing purpose unless laws or administrative regulations provide otherwise.
Payroll records may simultaneously be subject to employment, wage, tax, accounting, social insurance or dispute-related retention obligations.
The employer should therefore create a payroll retention schedule by record type instead of applying one arbitrary period to the entire employee file.
| Record category | Retention question |
|---|---|
| Payroll registers | Which wage, tax, accounting and dispute requirements require retention? |
| Payslips | How long are they needed for wage evidence and employee access? |
| Bank information | Is the current bank account still needed after employment ends? |
| IIT records | Which tax retention obligations apply? |
| Social insurance and housing fund records | Are they still required for contribution evidence or employee claims? |
| Medical information | Can the detailed medical record be removed while retaining only necessary leave evidence? |
| Dependent information | Is the information still required for tax or benefit purposes? |
| Former employee payroll access | Which records must remain available and which system permissions should be removed? |
Keeping everything forever “in case it is useful” is not a retention policy.
What Happens When an Employee Requests Access or Correction?
PIPL gives individuals rights concerning their personal information, including rights to know about processing, access or copy information and request correction of inaccurate or incomplete information.
Payroll teams should therefore have a process for requests such as:
- “My bank information is incorrect.”
- “My tax record contains the wrong ID number.”
- “I want a copy of the payroll information you hold about me.”
- “My dependent information is no longer current.”
- “Why does the overseas headquarters have access to my salary information?”
The response process should involve both the employer and payroll provider where necessary.
Deletion requests require separate analysis because the employer may still have a legal obligation to retain particular payroll records. PIPL recognizes that where a statutory retention period has not expired, information may need to remain stored even when other processing should stop.
Protect Payroll Data During File Transfers and Monthly Processing
Many payroll-data incidents do not begin with sophisticated cyberattacks. They begin with routine operational shortcuts.
Examples include:
- sending complete payroll registers through unencrypted email;
- sharing a payroll spreadsheet through a public link;
- using one password for multiple payroll files;
- sending an employee bank file to the wrong recipient;
- leaving former payroll staff with active system access;
- allowing managers to download payroll data for employees outside their team;
- storing ID documents in uncontrolled shared folders; and
- giving an overseas user full payroll access when only totals are required.
PIPL requires processors to take measures including internal management controls, classification, encryption or de-identification where appropriate, permission management, training and incident-response procedures.
Payroll operations should therefore include:
- role-based access;
- multi-factor authentication where supported;
- encrypted transfer channels;
- controlled payroll exports;
- audit logs;
- periodic access reviews;
- immediate access removal for leavers;
- secure backup and recovery;
- vendor-access monitoring; and
- documented incident escalation.
What Happens After a Payroll Data Breach?
Article 57 of PIPL requires a personal information processor to take immediate remedial action when personal information has been or may have been leaked, altered or lost.
Depending on the circumstances, notification to the responsible authorities and affected individuals may also be required.
A payroll incident plan should identify:
- who can stop or restrict payroll-system access;
- who investigates the incident;
- which employee records are affected;
- whether bank-account or identity data is involved;
- whether the payroll provider or another vendor is involved;
- whether overseas systems are affected;
- how affected employees will be contacted;
- which regulatory notifications must be assessed;
- how evidence will be preserved; and
- how future payroll processing will continue safely.
The payroll provider agreement should define incident-notification timing so the employer is not waiting for the vendor to complete its entire investigation before learning that employee data may have been exposed.
Payroll Data Privacy Should Be Audited Regularly
PIPL requires personal information processors to conduct regular compliance audits.
The Cyberspace Administration of China’s Personal Information Protection Compliance Audit Measures, effective May 1, 2025, further define this requirement.
Personal information processors handling information relating to more than 10 million individuals must conduct a compliance audit at least once every two years. Other processors should determine a reasonable regular audit frequency based on their circumstances.
A payroll privacy review should test:
- the payroll data inventory;
- processing purposes and legal bases;
- sensitive-personal-information classification;
- employee notices;
- consent records where required;
- payroll provider contracts;
- subprocessors;
- access permissions;
- overseas headquarters access;
- cross-border transfer documentation;
- privacy impact assessments;
- retention periods;
- employee rights procedures;
- security controls;
- incident procedures; and
- provider-exit and deletion records.
The broader HR audit process is covered separately in HROne’s China HR audit checklist.
Common Payroll Data Privacy Mistakes in China
Calling every payroll field sensitive personal information
This makes privacy classification less useful. Identify which fields are ordinary personal information and which meet PIPL’s sensitive-personal-information criteria.
Using one blanket employee consent
Different payroll activities may rely on different legal bases, while sensitive processing, third-party provision or cross-border transfer may trigger additional requirements.
Giving headquarters access to the entire payroll register
A global reporting need does not automatically justify access to employee bank details, ID documents, medical information or every salary component.
Assuming an outsourced payroll provider owns privacy compliance
The employer still needs to understand what information the provider processes, who else receives it and what happens when the service ends.
Allowing payroll providers to use undisclosed subprocessors
Vendor contracts should reflect the actual processing chain and applicable approval requirements.
Keeping former employee data indefinitely
Legal retention requirements should be documented by record type. They should not become a reason to retain every employee document forever.
Deleting records immediately whenever an employee asks
Employee privacy rights must be balanced with applicable legal retention requirements.
Assuming internal overseas access is not a cross-border transfer issue
Global group structure does not automatically remove China cross-border data requirements.
Sending payroll spreadsheets by uncontrolled email
Privacy compliance depends on actual operational controls, not only the wording of the employee privacy notice.
What Should Good China Payroll Data Governance Look Like?
A well-controlled payroll process should be able to answer five questions about every important employee data field:
- Why do we have it? There is a defined payroll, employment, tax, benefits or statutory purpose.
- Who can see it? Access is limited to people and providers who need the information.
- Where does it go? Local systems, vendors and overseas recipients are mapped.
- How long do we keep it? Retention is linked to a documented legal or operational requirement.
- What happens when it is no longer needed? Information is deleted, anonymized or restricted according to the applicable rule.
The objective is not to prevent payroll data from being used. Payroll cannot operate without employee information. The objective is to ensure that each use is necessary, controlled and documented.
Protect Payroll Data Without Breaking the Payroll Process
Payroll data privacy in China should be built into the monthly payroll process rather than managed as a separate legal document that nobody in payroll uses.
Employers should know which data enters payroll, which fields require enhanced protection, who can access employee-level records, what the payroll provider does with the data, whether headquarters can access it overseas and what happens to the information when employment or the vendor relationship ends.
HROne’s China payroll outsourcing service supports companies with their own mainland China employing entity that need structured local payroll administration. Payroll implementation can include controlled employee-data collection, payroll access processes, statutory administration, payroll reports and coordinated data handover under the agreed service scope.
Companies reviewing an existing China payroll process or preparing to move payroll to a new provider can contact HROne to discuss their payroll workflow, employee population, provider responsibilities and data-access requirements.
This article provides general information and does not constitute legal, cybersecurity or data-protection advice. PIPL obligations depend on the processing purpose, data categories, legal basis, employee population, vendors, systems, cross-border data flows and other facts. Obtain case-specific advice for higher-risk processing or international payroll-data transfers.
Frequently Asked Questions
Is employee salary personal information under PIPL?
Yes. Salary linked to an identifiable employee is personal information. However, salary is not automatically one of the sensitive-personal-information categories specifically listed in Article 28 solely because it is salary data.
Is an employee bank account sensitive personal information?
Yes. Financial account information is expressly included within PIPL’s sensitive-personal-information framework and requires enhanced controls.
Is medical leave information sensitive personal information?
Medical and health information is sensitive personal information. Payroll and HR teams should therefore minimize access to medical detail and process only the information required for the relevant leave, benefit or payroll purpose.
Can an employer process payroll data without employee consent?
PIPL provides legal bases other than consent, including processing necessary for employment contracts, qualifying HR management and statutory obligations. However, particular activities such as sensitive-personal-information processing, provision to other processors or cross-border transfers can trigger separate consent or other requirements.
Can a payroll provider process employee information for the employer?
Yes. Where the provider acts as an entrusted processor, PIPL requires the parties to define the processing purpose, scope, duration, data categories, security measures and responsibilities, and the employer must supervise the provider’s processing.
Can the payroll provider use subcontractors?
Where the relationship is entrusted processing under Article 21 of PIPL, the entrusted processor may not further entrust processing without the personal information processor’s consent. The company should therefore understand the actual provider and subprocessor chain.
Can overseas headquarters see China employee salary data?
Potentially, but the employer should assess whether the access is necessary and whether it constitutes a cross-border provision of personal information requiring additional PIPL controls. Access should be limited to the information headquarters genuinely needs.
Does all China payroll data have to be stored in China?
No blanket rule requires every company to keep all payroll information only in mainland China. However, localization and outbound-data requirements can apply depending on the processor, data involved, scale and applicable exemptions.
Is cross-border HR data automatically exempt from China data-export rules?
No. The 2024 rules provide an exemption from certain formal outbound-data mechanisms for qualifying cross-border HR-management transfers under specified conditions. The exemption does not remove the underlying PIPL obligations concerning matters such as notice, separate consent, impact assessment and security.
How long should payroll data be retained?
There is no single PIPL retention period for every payroll record. Personal information should generally be retained only as long as necessary, while payroll, wage, tax, accounting and statutory records may be subject to separate legal retention requirements.
Can an employee ask the employer to delete payroll records?
Employees have deletion rights in circumstances defined by PIPL, but employers may still need to retain particular records where a statutory retention period has not expired. In those cases, processing may need to be restricted rather than the information immediately deleted.
Does PIPL require payroll privacy audits?
PIPL requires regular personal-information compliance audits. Under the 2025 compliance audit measures, processors handling personal information relating to more than 10 million individuals must conduct an audit at least once every two years, while other processors should establish a reasonable regular audit frequency.
