Chinese laws oblige firms to cooperate with state bodies: Article 7 of the National Intelligence Law says that all firms and citizens must assist intelligence work. That doesn't mean someone reads your data. It means a contract can't protect you from such a request. For personal data from the EU there is a GDPR rule on top: China has no European Commission adequacy decision, so a transfer needs safeguards and the firm has to check the law of the destination country. Any lower price of a Chinese cloud doesn't cover this risk.
- Article 7 of the National Intelligence Law obliges all firms and citizens to assist intelligence work.
- GDPR doesn't forbid transfers to China, but China has no adequacy decision, so a transfer needs safeguards and a check of the law.
- A transfer without safeguards risks a fine of up to 20 million EUR or 4% of turnover.
- An American cloud has a similar question: 18 U.S.C. § 2713 reaches data outside the US too.
We cite the laws below from unofficial English translations (China Law Translate, Stanford DigiChina). We did not read the official Chinese text. Prices are from 25 October 2026 and excluding VAT.
What Chinese laws say
| Law | What it says |
|---|---|
| National Intelligence Law, 2017, amended 2018 | Art. 7: all firms and citizens must assist and cooperate with intelligence work. Art. 14: intelligence institutions may ask organizations for the support they need. |
| Data Security Law, in force since 1 Sep 2021 | Art. 35: state organs may demand data once it is approved under strict procedures, and the firms concerned must cooperate. Art. 36: data stored in China must not be handed to a foreign court or authority without the consent of Chinese authorities. |
| Cybersecurity Law, in force since 1 Jun 2017 | Art. 28: network operators provide technical support to security organs. Art. 37: operators of critical infrastructure store personal data and important data in China. |
| Counter-espionage Law, 2023 edition, in force since 1 Jul 2023 | Art. 41: telecommunications operators and internet service providers give security organs the technical support they need when they investigate. |
Remember two things from this. Article 35 of the Data Security Law prescribes an approval procedure, so access is not without rules. And Article 36 forbids handing data to a foreign authority without China's consent. For data stored in mainland China, a request from a European or American court can therefore run into a ban.
What GDPR says
GDPR doesn't forbid transferring personal data to a Chinese cloud. It does require the sender to have safeguards. For countries with adequate protection, the European Commission allows transfers without further safeguards. Its list includes Japan, Switzerland, the United Kingdom and US firms enrolled in the EU-US Data Privacy Framework. China is not on the list.
Without such a decision you use safeguards under Article 46, for example standard contractual clauses. But the European Data Protection Board (EDPB), in document 01/2020 of 18 June 2021, warns that the clauses don't bind the authorities of a third country, because they are not party to the contract. That's why you have to assess whether the law and practice of the destination country weaken the safeguards. With a Chinese provider, that is exactly a question about the laws in the table above.
The EDPB adds that when a provider needs data in readable form and the country's authorities have disproportionate access, it can't envisage an effective technical solution. When the provider holds the keys, ciphers won't help. A backup is a different case: if you encrypt it strongly and the keys stay only with you or in the EU, the EDPB considers that an effective supplementary safeguard.
A transfer without safeguards risks a fine of up to 20 million EUR or 4% of annual turnover, whichever is higher. The EDPB states this in Guidelines 04/2022 of 24 May 2023, using the example of a municipality that sent data to a country without adequate protection and without safeguards.
What Czech law says
Act No. 264/2025 Coll. gives the NÚKIB office the power to vet suppliers of strategically important services and, after a government decision, to ban the use of their performance in a critical part of the service (Sections 27 and 29). The provider of such a service must find out about suppliers of security-relevant deliveries and report them to the office within 10 days (Section 31). It must also make sure the service is available from the territory of the Czech Republic (Section 33). This applies only to services the government designates as strategically important, which is a smaller part of firms.
Decree No. 409/2025 Coll. for the higher-obligations regime has a wider effect. Under Section 9, contracts with significant suppliers must contain the relevant clauses from Annex 5. They include the right to audit, rules for subcontractors, an exit strategy and two clauses on foreign authorities: the supplier must inform the obliged person when a foreign authority asks for data (unless the law forbids it), and may hand data over only after verifying that the request is lawful, after trying to prevent the handover, and only to the extent necessary. Decree No. 410/2025 Coll. for the lower-obligations regime has, in Annex 2, a list of contract provisions without a clause on foreign authorities' requests. Which regime concerns you is explained in the article on NIS2 and the new act.
For financial firms, the DORA regulation (Regulation 2022/2554), which also covers contract terms with ICT service providers, has applied since 17 January 2025.
An American cloud has the same question
You have the same question with American providers. Section 2713 of Title 18 of the US Code, added on 23 March 2018 by the act known as the CLOUD Act, requires a service provider to hand over requested data in its possession or under its control regardless of whether it is located in the US or outside it. Data on AWS in Frankfurt therefore doesn't escape foreign law. The difference is that for American firms enrolled in the EU-US Data Privacy Framework a Commission adequacy decision exists, and for Chinese ones it doesn't.
Why a Chinese cloud tempts
Chinese providers tempt with price. On 8 April 2024 Alibaba Cloud cut prices for customers outside mainland China by 23% on average, and by up to 59% for compute, storage, networking and databases. We couldn't compare that price: we didn't get a public price list from Alibaba or Huawei for a server with 4 vCPU and 8 GB, so we have no figure to compare.
We did verify the European prices. A server with 4 vCPU and 8 GB costs 7.21 EUR a month at OVHcloud (VPS-2, "from" price on 12 months paid in advance), 31.27 EUR at Scaleway (DEV1-L, Paris) and 35.49 EUR at Hetzner (CPX32, 160 GB NVMe, servers in Germany and Finland). At AWS the same size comes to 141.62 USD. The tiers differ: OVHcloud has a 75 GB disk, Hetzner 160 GB. A detailed comparison of Hetzner and AWS is in the article on self-hosting.
What to do in a firm of twenty people
- Find out where the data sits. Check your ERP, CRM, accounting, source code and backups. For each system write down the provider, the country where the company is based and the country where the servers stand.
- Sort the data by how important it is. Source code, production methods, contracts and personal data need the most protection. A public website needs none.
- Ask your suppliers. You want to know in writing how they handle requests from foreign authorities and who their subcontractors are. Annex 5 of Decree 409/2025 Coll. is a model.
- Move sensitive data to a provider with a clear jurisdiction. The most sensitive first. You can write the move plan in a few pages.
- Encrypt backups with keys only you hold. That is a case the EDPB accepts as an effective safeguard.
How to secure a server and verify that it holds up is something the cyber protection service can help with.
Common questions
Is transferring data to a Chinese cloud forbidden under GDPR?
Not directly. China has no Commission adequacy decision, so a transfer needs safeguards under Article 46 and the firm has to check the law of the destination country. A transfer without safeguards risks a fine of up to 20 million EUR or 4% of turnover.
Which Chinese laws oblige firms to cooperate with the state?
According to unofficial translations, the National Intelligence Law (Arts. 7 and 14), the Data Security Law (Art. 35), the Cybersecurity Law (Art. 28) and the Counter-espionage Law (Art. 41).
Does the same apply to American providers?
The US Code (18 U.S.C. § 2713, added by the act known as the CLOUD Act) requires a provider to hand over data in its control regardless of where it is located. For American firms in the EU-US Data Privacy Framework, though, the Commission has issued an adequacy decision.
Does encrypting data in the cloud help?
For backups yes, if the keys are held only by your firm or a trusted entity in the EU. If the provider needs the data in readable form and holds the keys, the EDPB sees no effective technical solution.
How much does a server with 4 vCPU and 8 GB cost in Europe?
According to price lists of 25 October 2026, from 7.21 EUR at OVHcloud on a year paid in advance to 35.49 EUR at Hetzner, excluding VAT. For Alibaba and Huawei we didn't get a comparable price.
Sources
- China Law Translate, PRC National Intelligence Law (as amended in 2018), unofficial translation: https://www.chinalawtranslate.com/en/national-intelligence-law-of-the-p-r-c-2017/
- Stanford DigiChina, Data Security Law of the PRC, translation, in force since 1 Sep 2021: https://digichina.stanford.edu/work/translation-data-security-law-of-the-peoples-republic-of-china/
- Stanford DigiChina, Cybersecurity Law of the PRC, translation, in force since 1 Jun 2017: https://digichina.stanford.edu/work/translation-cybersecurity-law-of-the-peoples-republic-of-china-effective-june-1-2017/
- China Law Translate, Counter-espionage Law (2023 ed.), in force since 1 Jul 2023: https://www.chinalawtranslate.com/en/counter-espionage-law-2023/
- 18 U.S.C. § 2713, Cornell Legal Information Institute, viewed 25 Oct 2026: https://www.law.cornell.edu/uscode/text/18/2713
- European Commission, adequacy decisions, viewed 25 Oct 2026: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en
- EDPB, Recommendations 01/2020 on supplementary measures, version 2.0, 18 Jun 2021: https://www.edpb.europa.eu/system/files/2021-06/edpb_recommendations_202001vo.2.0_supplementarymeasurestransferstools_en.pdf
- EDPB, Guidelines 04/2022 on the calculation of administrative fines, version 2.1, 24 May 2023: https://www.edpb.europa.eu/system/files/2023-06/edpb_guidelines_042022_calculationofadministrativefines_en.pdf
- Act No. 264/2025 Coll., zakonyprolidi.cz, viewed 25 Oct 2026: https://www.zakonyprolidi.cz/cs/2025-264
- Decree No. 409/2025 Coll., zakonyprolidi.cz, in force since 1 Nov 2025: https://www.zakonyprolidi.cz/cs/2025-409
- Decree No. 410/2025 Coll., zakonyprolidi.cz, in force since 1 Nov 2025: https://www.zakonyprolidi.cz/cs/2025-410
- ESMA, Digital Operational Resilience Act (DORA), viewed 25 Oct 2026: https://www.esma.europa.eu/esmas-activities/digital-finance-and-innovation/digital-operational-resilience-act-dora
- Alibaba Group, Alibaba Cloud Launches Price Cuts for International Customers, 8 Apr 2024: https://www.alibabagroup.com/en-US/document-1715106160694001664
- Hetzner, Price Adjustment 15 June 2026: https://docs.hetzner.com/general/infrastructure-and-availability/price-adjustment/
- Hetzner Cloud, Regular Performance, viewed 25 Oct 2026: https://www.hetzner.com/cloud/regular-performance/
- AWS, EC2 on-demand price list, Linux, Frankfurt (c6i.xlarge), data of 23 Oct 2026: https://b0.p.awsstatic.com/pricing/2.0/meteredUnitMaps/ec2/USD/current/ec2-ondemand-without-sec-sel/EU%20(Frankfurt)/Linux/index.json
- OVHcloud, VPS price list (VPS-2), viewed 25 Oct 2026: https://www.ovhcloud.com/en-ie/vps/
- Scaleway, virtual instances price list (DEV1-L), viewed 25 Oct 2026: https://www.scaleway.com/en/pricing/virtual-instances/
Ollama: how to run local AI over your own company data
Self-hosting your business software: Hetzner vs AWS vs managed cloud
CRM comparison: Raynet, Pipedrive, HubSpot, Zoho and Odoo by price list
