Does Degreed Work in China? Data Residency, ICP & Cross-Border Rules
Degreed, a skills/learning experience platform, holds your China employees' identities, learning records and skills profiles. It runs on Microsoft Azure across the US, Europe and Canada — no mainland-China region — so that data sits offshore under PIPL, and its skill scoring engages Article 24.
Does Degreed work in China?
The question is not whether Degreed loads in Shanghai — it is where your China employees' learning records and skills profiles live. Degreed runs on Microsoft Azure across the United States, Europe and Canada with no mainland-China region, so that workforce personal information sits offshore as a PIPL cross-border transfer before it is a training decision.
Degreed is a skills platform: it rates skills, runs AI-powered skill reviews, and personalizes what each person is shown from their proficiency profile. Held offshore, your China staff's identities, learning activity and skills scores are personal information leaving the country (PIPL Articles 38–40, with notice and separate consent), and for a CIIO or high-volume handler the Cybersecurity Law wants it stored in the mainland (Article 39, formerly Article 37). Because the platform scores skills and auto-recommends learning, PIPL Article 24 on automated decision-making gives each employee rights, including a way to opt out of decisions made solely by automated processing.
This is a risk map, not a verdict — what applies turns on your entity, data volumes and workforce. Our China team can map your exposure with you →
What Degreed's own documentation says about China
| Fact | Primary source |
|---|---|
| Degreed runs on Microsoft Azure across the United States, Europe and Canada — none in mainland China. Degreed's Trust Center states the platform is "Hosted on Microsoft Azure across the United States, Europe, and Canada with high availability and redundancy," and its own stat callout lists "3 Regions." No mainland-China region is published, so a China employee's learner and skills record is held offshore by design. | Degreed Trust Center — Cloud Infrastructure (explore.degreed.com), retrieved 2026-10-13 |
| All client data is housed in Microsoft Azure datacenters; for enterprise customers Degreed is the processor and your organization the controller. Degreed's security page: "Microsoft Azure is our Cloud Service Provider (CSP)," and "The infrastructure of the Degreed platform, including all client data, is housed securely in Microsoft Azure datacenters." Its privacy policy casts Degreed as processor and the employer as data controller — so the PIPL cross-border and residency duties for your China employees' data fall on you, the handler. | Degreed Security (degreed.com/experience/security) and Privacy Policy (degreed.com/about/privacy), retrieved 2026-10-13 |
| Your China employees' learning and skills data held abroad is a cross-border transfer, and may have to stay in-country. Moving your mainland staff's identities, learning activity and skills profiles out of China engages PIPL Articles 38–40 — notice, separate consent and a transfer mechanism (CAC security assessment, standard contract or certification). If you are a critical information infrastructure operator or large-volume handler, the Cybersecurity Law Article 39 (formerly Article 37) requires that data be stored in the mainland — a residency duty an offshore-only platform cannot meet. | PIPL Articles 38–40; Cybersecurity Law Article 39 (formerly Article 37) |
| Scoring skills and auto-recommending learning is automated decision-making about employees. Degreed rates skills and personalizes what each worker is shown from their proficiency profile. To the extent those outputs are decisions made by automated processing, PIPL Article 24 requires transparency and fairness and gives the individual the right to refuse a decision based solely on automated processing — a right a China workforce deployment must be able to honor. Confirm the exact scope with counsel. | PIPL Article 24 (automated decision-making) |
Sources verified by the 21YunBox compliance team on 2026-10-13.
Ask whether Degreed “works” in mainland China and the honest answer starts with your employees’ data, not with page-load speed. Degreed is a skills and learning experience platform: it holds the identities of your workforce, their learning activity and completion records, and — distinctively — a scored profile of each person’s skills. Degreed runs that service from Microsoft Azure data-center regions it names as the United States, Europe and Canada, with none inside mainland China. So for the Chinese employees in your Degreed tenant, the learner and skills record is personal information held offshore the moment it is created — a cross-border transfer before it is ever a training decision. And because Degreed rates skills and recommends learning by automated processing, a second, separate rule attaches to the very scores it produces. Reachability is real, but it is the least of what you are deciding.
Degreed in China at a glance
| What decides it | In Degreed's own terms |
|---|---|
| Where it runs | Degreed's Trust Center: the platform is “Hosted on Microsoft Azure across the United States, Europe, and Canada,” and a stat callout lists “3 Regions.” No region is inside mainland China. |
| What it holds | Learner identities, learning activity, and a scored skills/competency profile per person — Degreed says “Your skill definitions are used in Maestro's AI-powered skill reviews.” That is workforce personal information, HR-adjacent. |
| Where that data sits | Degreed's security page: “The infrastructure of the Degreed platform, including all client data, is housed securely in Microsoft Azure datacenters” — offshore. For your Chinese staff that is a cross-border transfer PIPL governs, with a localization duty offshore regions cannot meet. |
| Automated skills decisions | Degreed rates skills and uses that profile to “deliver a highly personalized” learning experience “according to their unique proficiency.” Where decisions about employees are made by automated processing, PIPL Article 24 gives the individual rights, including an opt-out. |
| On your public site | A China-facing learning portal is a site your mainland users reach; the ICP filing attaches to that serving site, not to Degreed. |
| Is it reachable? | Whether Degreed's pages render cleanly for mainland users is a delivery question — separate from, and lesser than, whether you are cleared to hold this employee data at all. |
Where Degreed runs — and that settles the first question
Degreed is hosted software, and in its own Trust Center it names where: “Hosted on Microsoft Azure across the United States, Europe, and Canada with high availability and redundancy,” with a stat callout listing “3 Regions.” Its security page adds that “Microsoft Azure is our Cloud Service Provider (CSP),” and that “The infrastructure of the Degreed platform, including all client data, is housed securely in Microsoft Azure datacenters.” There is no mainland-China region. So wherever your tenant sits, the learner and skills data Degreed keeps for your Chinese employees is held offshore — in the United States, Europe or Canada — not in the mainland. That single fact decides the compliance question before reachability is ever measured: this is not about whether a course page paints in Shanghai, but about workforce personal data leaving the country the moment Degreed records it.
Prong one — your China employees’ learning and skills data is a cross-border transfer
Degreed’s purpose is to know your people’s skills. Its privacy policy casts Degreed as a data processor and your organization as the controller for enterprise users — which means the obligations for your Chinese employees’ personal information fall on you, the handler, not on the vendor. Their names, roles, learning activity, assessment results and a running, scored skills profile accumulate in the tenant, and Degreed holds all of it as “client data … housed securely in Microsoft Azure datacenters” abroad. For your mainland staff, moving that personal information out of China engages the Personal Information Protection Law: you must give notice, obtain separate consent, and clear one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL localization duties) — a residency requirement an offshore-only Degreed cannot satisfy. This is HCM-adjacent employee data, not “can the video stream,” and it is the spine of the question.
Prong two — scoring skills is automated decision-making about employees
Degreed does not just store learning; it judges it. The platform rates skills — “Your skill definitions are used in Maestro’s AI-powered skill reviews” — and then uses each person’s scored profile to “deliver a highly personalized, impactful learning experience” so that “people receive the right content to grow according to their unique proficiency.” When a platform scores, ranks or auto-recommends based on an employee’s profile, those outputs are decisions produced by automated processing. PIPL Article 24 governs exactly that: automated decision-making must be transparent and fair, and the individual has the right not to be subject to a decision made solely by automated means — including a way to opt out. A China workforce deployment of Degreed has to be able to surface and honor those rights. How far Article 24 reaches depends on how you configure skill reviews and recommendations, and is worth settling with counsel — but it is a question a hosting-and-speed check never asks.
Why a reachability check misses all of this
A probe that only asks “does Degreed load from Shanghai?” measures the wrong thing. It cannot see that the learner and skills records are held on Azure outside the mainland, it cannot see the notice-consent-and-mechanism duties that attach to that cross-border transfer, and it cannot see that scoring an employee’s skills engages Article 24. Making the offshore platform merely reachable does not move the regulated data in-country, and it does not create the opt-out an automated skills decision requires. Reaching a Chinese audience and being cleared to hold and judge their data are two different tests — and only one of them shows up on a latency chart.
Where 21YunBox fits — map, localize, deliver
We do not ask you to leave Degreed. We add the layer a hosted, offshore skills platform cannot. Map: we inventory what your tenant holds — employee and learner identities, enrolments, assessments, scored skills profiles and manager/org links — where it is hosted, and whether your skill-scoring and auto-recommendation flows amount to automated decision-making. Localize and govern: we help you keep the regulated employee learning and skills data in-country, set the Article 13/23 notice and consent basis, honor the Article 24 opt-out for automated skills and learning decisions, and minimize what crosses the border. Deliver: we ICP-file any China-facing learning portal and stand up compliant, in-country delivery with the 21YunBox Optimizer in front of what you already run — no rebuild, no second codebase, no move off Azure. 21YunBox never uses or suggests circumvention of any kind.
This is a risk map, not a verdict: whether you owe notice and consent, a transfer mechanism, in-country storage, an ICP filing, Article 24 handling, or some combination depends on your entity, your data volumes and your workforce — worth settling with counsel before you roll Degreed out to China staff.
Related reading:
- Cross-border data transfers under PIPL
- China’s Personal Information Protection Law
- How to get an ICP filing for China
