Does Dialpad Work in China? PIPL Cross-Border, Telecom Licensing & Data Residency
Dialpad is a US-cloud business-phone and Ai contact-center platform that transcribes and sentiment-scores every call. Carrying your China users' calls, recordings, and transcripts to its offshore Google Cloud storage is a PIPL cross-border transfer of sensitive voiceprint data, while providing voice and contact-center service in China touches a value-added telecom license a foreign platform cannot hold. A compliance-first look at the licensing door and the residency exposure.
Does Dialpad work in China?
Providing voice and contact-center service in China needs a value-added telecom license a foreign platform can't hold, and the calls, recordings, and Ai transcripts Dialpad generates for every conversation are sensitive personal data sitting on its offshore cloud.
Dialpad is a US-cloud business-phone and Ai contact-center platform; its Trust Center states that call records, recordings, and transcripts are stored in the United States via Google Cloud Platform, with no mainland-China region. Because Dialpad Ai transcribes and sentiment-scores every call, each conversation's content, transcript, and automated score are written offshore — a PIPL cross-border transfer of sensitive personal information, since a recording is a voiceprint (Article 28) that needs a separate consent (Article 29), and where the Ai decides routing or scoring the Article 24 automated-decision duty applies. The lawful lever is to route the China voice and contact-center leg through a licensed in-country operator and keep recordings and interaction data in-country — not to make the offshore platform reachable. On the telecom leg 21YunBox is advisory; we hold no China telecom license.
This is a map of the exposure, not a ruling — settle the specifics with qualified counsel against what you actually run. Our China team can map your exposure →
What Dialpad's own documentation says about China
| Fact | Primary source |
|---|---|
| Dialpad stores call records, recordings, and transcripts in the United States on Google Cloud — there is no mainland-China region. Dialpad's Trust Center states: “All permanent customer data, such as contact lists, call records, recordings, and transcripts, is stored in the United States via Google Cloud Platform, and backed up daily,” with transient data held “no more than 72 hours.” Carrying those records from or about mainland users is a PIPL cross-border transfer (Articles 38–40). | Dialpad Trust Center, “Where and how is my data stored?” (dialpad.com), retrieved 2026-10-10 |
| Dialpad Ai transcribes and sentiment-scores every call by design. Dialpad's own page states “Dialpad AI transcribes every conversation in real time, producing a searchable record,” and that it “performs sentiment analysis in real time.” Every call therefore generates content, a transcript, and an automated score held on Dialpad's cloud; a recording is a voiceprint — sensitive personal information under PIPL Article 28 — and where the Ai decides routing or scoring, the PIPL Article 24 automated-decision duty applies. | Dialpad, “Conversation intelligence” (dialpad.com), retrieved 2026-10-10 |
| Running voice or contact-center service for mainland users is a licensed value-added telecom business. China's Measures for the Administration of Telecommunications Business Licensing (MIIT Order No. 42, in force September 1, 2017) require a Value-Added Telecommunications Business License (增值电信业务经营许可证); foreign-investment limits mean a foreign platform cannot hold it directly, so the lawful route carries the China voice leg through a licensed in-country operator. | Measures for the Administration of Telecommunications Business Licensing, MIIT Order No. 42 (gov.cn), promulgated 2017-07-03, in force 2017-09-01 |
| A voiceprint is sensitive personal information, and high-volume handlers face an in-country storage duty. Under PIPL a biometric voiceprint is sensitive personal information (Article 28) requiring a separate consent (Article 29); for a critical-information-infrastructure operator or high-volume handler, personal information collected in the mainland must be stored there under Cybersecurity Law Article 39 (formerly Article 37) — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged. | PRC Personal Information Protection Law, Arts. 24/28/29 (cac.gov.cn), retrieved 2026-10-10 |
Sources verified by the 21YunBox compliance team on 2026-10-10.
For a China-facing operation, the question to settle about Dialpad is not whether an agent can sign in or whether a call connects — it is whether the service may lawfully carry that call at all, and where the record of it is allowed to come to rest. Dialpad is both a cloud business-phone and unified-communications platform (Dialpad Connect) and an Ai-powered cloud contact center (Dialpad Ai Contact Center), and its defining feature is that Dialpad Ai transcribes, summarizes, and sentiment-scores every conversation in real time. So each call generates not just a recording but a searchable transcript and an automated score, and all of it is written to Dialpad’s offshore cloud. That raises four prongs at once: a value-added telecom-business license a foreign platform cannot hold; a PIPL cross-border transfer of recordings, transcripts, and call detail records; a voiceprint that is Article 28 sensitive personal information requiring Article 29 separate consent; and, where the Ai decides routing or scoring, the Article 24 automated-decision duty. None of these turn on milliseconds.
Dialpad in China at a glance
| What decides it | In Dialpad's own terms — and China's law |
|---|---|
| What it is | Dialpad — a cloud business-phone and unified-communications platform (Dialpad Connect) and an Ai-powered contact center (Dialpad Ai Contact Center): calls, voicemail, video, team messaging, IVR, call and screen recording, and built-in Ai transcription. It is operated by Dialpad on Google Cloud; there is no Dialpad mainland-China region or China telecom entity you run it from, and no on-premises build to localize it to. |
| Where the records live | Dialpad's Trust Center states that all permanent customer data — contact lists, call records, recordings, and transcripts — is stored in the United States via Google Cloud Platform, with transient data held no more than 72 hours. No mainland-China region exists to select, so the records tied to your China callers come to rest offshore — a PIPL cross-border transfer (Articles 38–40, 数据出境): notice, a separate consent, and one transfer mechanism. |
| The telecom-licensing door | Providing voice, telephony, and contact-center service to users in the mainland is a value-added telecom business. Under the Measures for the Administration of Telecommunications Business Licensing (MIIT Order No. 42) it needs a Value-Added Telecommunications Business License (增值电信业务经营许可证) a foreign platform cannot hold directly — so the lawful route carries the China voice leg through a licensed in-country operator, not Dialpad alone. |
| Voiceprint = sensitive PI, plus residency | A call recording is the speaker's voice — a biometric identifier — so recordings, and the transcripts and sentiment scores derived from them, are sensitive personal information under PIPL Article 28, which requires a specific purpose and a separate consent (Article 29). For a critical-information-infrastructure operator or high-volume handler, in-country storage can also bite: Cybersecurity Law Article 39 (formerly Article 37) — the 2025 Cybersecurity Law amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged. |
| Reachability is not the axis — the lawful path | Dialpad is not "blocked," but reachability was never the question. Because Dialpad Ai transcribes and scores every call, each conversation's content, transcript, and automated score sit offshore, and where the Ai decides routing or scoring the PIPL Article 24 automated-decision duty applies. The lawful path routes the China voice and contact-center leg through a licensed in-country operator, keeps recordings, transcripts, and CDRs in-country with the Article 29 consent, and delivers China-facing surfaces on ICP-filed infrastructure. On telecom 21YunBox is advisory — we hold no China telecom license. |
What you actually carry and store — calls, recordings and interaction data
A Dialpad deployment is dense with personal information, and some of it is the most sensitive kind there is. Every business call and contact-center interaction carries the caller’s and agent’s voice, their name and phone number, account references, and whatever happens to be said aloud — an address, a health complaint, a card number read to settle a bill. On top of that raw content, Dialpad Ai generates a layer of its own: it transcribes every conversation in real time, writes call summaries, scores live sentiment, surfaces real-time assist cards to agents, and even transcribes voicemail. So a single call becomes a recording, a searchable transcript, a sentiment score, and a call detail record — plus contact lists, IVR and keypad entries, and the agent-desktop context around it. Dialpad’s own Trust Center is explicit about where that comes to rest: permanent customer data, including recordings and transcripts, is stored in the United States via Google Cloud Platform, with transient data held no more than 72 hours. There is no mainland-China region, and because Dialpad is a multi-tenant cloud service there is no on-premises build to point at mainland infrastructure. For your China callers, that means the content and the Ai-derived records of every conversation are written offshore the moment they are created.
Two doors: a telecom license you can’t hold, and a cross-border transfer of sensitive voice data
The first door is licensing. Providing voice, telephony, and contact-center service to users in the mainland is a regulated value-added telecom business: a domestic phone number, carriage of calls on China’s networks, and the operation of a contact center all touch the Value-Added Telecommunications Business License (增值电信业务经营许可证) under the Measures for the Administration of Telecommunications Business Licensing (MIIT Order No. 42). Foreign-investment rules mean a foreign platform cannot hold that license directly, so a foreign UCaaS/CCaaS vendor cannot, on its own, lawfully originate or terminate domestic Chinese telephony or run a licensed in-country contact center — reaching mainland users lawfully means routing through a licensed in-country operator. The second door is data. The recordings, transcripts, sentiment scores, CDRs, and contact data you carry are personal information, and a recording is a voiceprint — a biometric identifier that is sensitive personal information under PIPL Article 28, which cannot be anonymized away and which Article 29 says needs a separate, specific consent distinct from the agreement to use the service. Carried to a cloud with no mainland-China region, that is a cross-border transfer under PIPL Articles 38–40 (数据出境) performed by you, the handler: notice, the separate consent, and one approved transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. For a critical-information-infrastructure operator or a high-volume handler, in-country storage is a duty in its own right under Cybersecurity Law Article 39 (formerly Article 37). And because Dialpad Ai scores sentiment and can drive routing and assist, where those outputs decide how an individual is handled the PIPL Article 24 automated-decision duty is engaged as well.
Reaching the platform isn’t the question — a licensed in-country path is
Dialpad connects, and its Ai works well; neither fact is the one that decides whether you may run it for China. The deciding questions are whether the voice leg is carried by an operator licensed to carry it, and whether the sensitive records it generates had a lawful basis to leave the country — or whether they had to stay in the first place. The lawful answer is not to make an offshore platform reachable and not a concealed route that ships the data offshore anyway; it is to carry the China voice and contact-center leg through a licensed in-country operator, keep recordings, transcripts, and CDRs in-country, and obtain the Article 29 separate consent for the voiceprint data before any of it moves. You can narrow what crosses — minimize, pseudonymize, suppress card-entry segments, keep certain transcripts out of certain flows — but as long as the storage region is the United States, region and redaction choices only decide which offshore region and how much, not whether it crosses. On the telecom leg our role is advisory and lighter: 21YunBox does not hold a China telecom license and is not a carrier. Because whether you are a CII operator, which volume thresholds you cross, which transfer mechanism fits, and how the Article 24 position applies all turn on facts only your team and counsel hold, treat this page as a map of the exposure, not a ruling: settle the specifics with qualified counsel against what you actually run.
The lawful path — map, localize, deliver
Reaching Chinese users with Dialpad the lawful way has a shape, and it keeps Dialpad where it already runs. 21YunBox is a compliant overlay, not a migration, and for a platform like Dialpad we are a partner to it, not a competitor. We map your exposure first — reading the PIPL cross-border, data-residency, sensitive-PI, telecom-licensing, and Article 24 automated-decision obligations against your entity, your call and recording volumes, your Ai use, and who your callers and agents actually are, so you know exactly what counsel and a licensed local carrier need to confirm. We localize the records that must stay on mainland soil — standing up consented, in-country processing and storage for the recordings, transcripts, sentiment data, and CDRs that cannot lawfully sit offshore, and routing the China voice and contact-center leg through a licensed in-country operator where interactive calling is in scope — a lawful, in-country, licensed path, never a concealed route that ships the data offshore. And we deliver every China-facing surface — the agent console, the customer portal, the callback or intake form — over ICP-filed, in-country infrastructure (the 21YunBox Optimizer), in front of the Dialpad stack you already run, with no rebuild and no second codebase. On the telecom leg our role is advisory and lighter: 21YunBox does not hold a China telecom license and is not a carrier; that license and the carrier relationship sit with a licensed local provider and your counsel. The result is a communications stack that runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind.
Related reading:
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law — data localization (Article 39, formerly Article 37)
- China’s data export security assessment measures
- How to get an ICP filing for China
