Does Liferay Work in China? Where You Host It, ICP & Data Residency

Liferay is one of the most widely deployed digital experience platforms in the enterprise, and “does Liferay work in China” has an unusual answer: it depends almost entirely on where it runs. Liferay DXP is not a single hosted service with one endpoint the mainland can allow or block — on its own platform page it is “open-source software” that “supports SaaS, PaaS, and on-premise.” So the honest version of the question is not “is Liferay blocked,” but “is the place you run Liferay licensed to serve the public in mainland China, and is the data it collects allowed to live there.”

Those are two compliance questions, and they are the half of “does Liferay work in China” that no amount of theming, clustering or caching answers. Below is what Liferay documents about how it is deployed, the ICP filing a public mainland site turns on, and how China’s Personal Information Protection Law treats the data your Liferay portal holds — in Liferay’s own words and China’s own law, so you can take it to counsel rather than to a benchmark.

Liferay in China at a glance

What Liferay actually is — software you deploy, not a service that can be blocked

Liferay’s own platform page is the place to start, because it answers the question most “does it work in China” articles skip: who provides the infrastructure. Liferay describes Liferay DXP as “open-source software” and says it “supports SaaS, PaaS, and on-premise” — in other words, you decide whether it runs on your own servers, in a cloud you control, or on Liferay’s managed cloud. It is a platform you operate, not a managed service pinned to one address the mainland can permit or refuse.

That single fact reframes the whole question. There is no one “Liferay endpoint” for China’s network controls to allow or deny, so “is Liferay blocked in China” is the wrong lens. Reachability still matters at the edges — a portal served from offshore can be slow for mainland visitors, and themes or widgets that pull in third-party fonts, analytics or map libraries can load assets that are themselves degraded inside the mainland — but that is a delivery matter, not what decides whether you may run Liferay for a Chinese audience. What decides that are the two doors below, and both of them turn on where the portal runs.

The first door: an ICP filing for a public mainland site

Showing a public website to people in mainland China turns on a permission that has nothing to do with Liferay’s code: an ICP filing (备案). Under State Council Order No. 292 (Article 4) and MIIT Order No. 33, that filing attaches to a hosting resource physically inside the mainland and to a mainland legal entity — a site served from offshore has nothing in-country for it to bind to.

This is exactly where “where it runs” becomes decisive. Deploy Liferay on an offshore server — or on Liferay’s managed cloud, whose regions sit outside the mainland — and the filing has no resource to sit on; move the same portal onto licensed infrastructure inside the mainland and it becomes filable without re-building a single page or integration. The filing follows the hosting, and the hosting is your choice — which is why the ICP question is about your deployment, not about Liferay.

The second door: data residency for the people your portal serves

A Liferay portal rarely just displays pages. User accounts, profiles, membership and community records, and anything a form or case-management module captures all land in the portal’s own database — and that database lives wherever you deploy it. For a mainland audience, that makes data residency the second door.

A visitor in China’s account details and submissions are personal information. Hold the database offshore — whether you self-manage it or run on Liferay’s cloud — and you are carrying that personal information out of the mainland, which China’s Personal Information Protection Law governs as a cross-border transfer (Chapter III, Articles 38–43: notice, separate consent, and one permitted transfer mechanism — a CAC security assessment, the CAC standard contract, or certification). The weight scales with volume and role rather than with using Liferay at all: under the CAC’s March 2024 cross-border rules, a non-CIIO moving fewer than 100,000 individuals’ non-sensitive personal information in a calendar year is exempt from those mechanisms, while a CIIO or large-volume handler must keep personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)).

This door is sharper if you run Liferay’s managed cloud rather than self-hosting: there you do not choose the data center — Liferay does, from its published regions, and that list has no mainland-China location (the nearest are Japan and Australia). So the portal’s content and your users’ data sit offshore by design, and the in-country storage a CIIO or large-volume handler owes is not something an offshore region can satisfy. Which of these applies to you is a question for counsel, so treat the specifics as a risk picture rather than a default.

Where 21YunBox fits — a compliant overlay, not a migration

You keep Liferay exactly as you build it today — same modules, same themes, same integrations, same workflow. What a mainland-China audience adds is the one thing a deployment’s location dictates and tuning cannot: ICP-filed delivery from inside the mainland, placed in front of your existing Liferay origin, with a fixed in-country entry so each visitor’s real IP is not carried across the border. Our China team maps which obligations apply to your entity and the data your Liferay portal holds, handles the ICP filing, and stands up the in-country entry — and where the law requires your users’ data to stay on Chinese soil, helps you run the Liferay instance and its database inside the mainland rather than on an offshore cloud region. No rebuild, no second codebase, no re-platform.

Get a compliance assessment →

Related reading:

• What is the China ICP license, and how do you get one?
• Cross-border data transfers under PIPL