Does Dynatrace Work in China? PIPL, Data Residency & Where Your Telemetry Lands
Dynatrace SaaS runs only in offshore cloud regions — AWS, Azure and Google Cloud, with no mainland-China location — and its monitoring captures end users' personal data by design. Monitoring mainland users exports their personal information offshore, a cross-border transfer under PIPL. A compliance-first look at the data-residency door.
Does Dynatrace work in China?
Yes — Dynatrace reaches mainland China, but reachability was never the question. Dynatrace SaaS captures your end users' personal data by design and stores it in offshore cloud regions with no mainland-China location, so monitoring Chinese users exports their personal information out of the country — a cross-border transfer China's law governs.
In Dynatrace's own words it "may capture end-user data, potentially including personal and confidential information about your end users" — client IPs and HTTP headers "captured automatically," and, with Session Replay, "all HTML source code" and interactions "obtained through form fields." That data "is stored in Amazon Web Services (AWS), Microsoft Azure, or Google Cloud data centers" whose region list — N. Virginia, Ireland, Frankfurt, Singapore, Tokyo, Sydney and more — includes nowhere in mainland China. Monitor mainland users and their personal information leaves the country: a cross-border transfer under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43), with a storage-in-China duty for CIIOs and large-volume handlers (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). The table below is Dynatrace's own wording and the rule each line triggers.
This is a risk map, not a verdict — how much exposure you carry turns on what Dynatrace captures, how much, and whose data it is. Our China team can map your exposure with you →
Compliance snapshot
- ! Dynatrace captures end users' personal data by default — IPs, actions, Session Replay
- ✕ No mainland-China SaaS region; your telemetry is stored offshore
- ! Mainland users' data crosses the border — PIPL cross-border rules apply
- ! CIIOs and high-volume handlers owe a data-residency duty offshore can't meet
- ✓ Dynatrace is reachable — but reachability isn't the compliance test
What Dynatrace's own documentation says about China
| Fact | Primary source |
|---|---|
| Dynatrace captures your end users' personal data by design. In Dynatrace's own words, "From monitored environments, Dynatrace may capture end-user data, potentially including personal and confidential information about your end users," and in request monitoring "URLs, client IPs, and certain HTTP header fields are captured automatically." A client IP address and a user ID are themselves personal information under China's Personal Information Protection Law — so what flows to Dynatrace is regulated personal data, not anonymous telemetry. | Dynatrace Docs — Personal data captured by Dynatrace (docs.dynatrace.com), retrieved 2026-10-07; PIPL |
| Session Replay records the session itself, not just metrics. Dynatrace's data-privacy documentation states Session Replay captures "all HTML source code" together with interactions "obtained through form fields, attributes, content, and interactions such as mouse movement and scrolling" — and its product pages describe replaying "each click or tap in a movie-like experience." For mainland users that can mean names, contact details and on-screen content: sensitive personal information whose export is exactly what PIPL's cross-border rules govern. | Dynatrace Docs — Personal data captured by Dynatrace & Session Replay (docs.dynatrace.com), retrieved 2026-10-07; PIPL |
| Dynatrace SaaS stores that data offshore, with no mainland-China region. Dynatrace states its data "is stored in Amazon Web Services (AWS), Microsoft Azure, or Google Cloud data centers," and its published region list runs through N. Virginia, Oregon, Ireland, Frankfurt, London, Tel Aviv, Singapore, Tokyo, Mumbai and Sydney — none inside mainland China. Monitor mainland users from any of them and their personal information leaves the country: a cross-border transfer under PIPL, which requires notice, separate consent and a transfer mechanism (Articles 38–43). | Dynatrace Docs — Data security controls / SaaS regions (docs.dynatrace.com), retrieved 2026-10-07; PIPL Articles 38–43 |
| Masking lowers exposure — it does not bring the data onshore. Dynatrace provides data-privacy controls to mask personal data at capture, storage and display, which is prudent but still stores the result in an offshore region. The duties that remain are Chinese law's, not Dynatrace's: a cross-border transfer still needs a lawful basis, and a critical information infrastructure operator or large-volume handler must keep personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore Dynatrace region can meet. | Dynatrace Docs — Data privacy / masking personal data (docs.dynatrace.com), retrieved 2026-10-07; PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the question about Dynatrace is not whether it loads — it is where your users’ monitoring data is allowed to live. Dynatrace is an observability platform, and by its own documentation it captures end users’ personal data — client IPs, user actions, and, with Session Replay, the content of their screens — then stores it in offshore cloud regions that include no mainland-China location. Dynatrace is reachable from inside China; the exposure is that monitoring Chinese users ships their personal information out of the country, which is a question for China’s data law, not for your latency budget.
Dynatrace in China at a glance
| What decides it | In Dynatrace's own terms |
|---|---|
| Where it runs | Dynatrace SaaS runs in AWS, Azure and Google Cloud regions across the US, Europe, the Middle East and Asia-Pacific — Singapore, Tokyo, Mumbai and Sydney among them. None is inside mainland China. |
| What it captures | It “may capture end-user data, potentially including personal and confidential information”; URLs, client IPs and HTTP headers are “captured automatically,” and Session Replay records “all HTML source code” and form-field interactions. |
| Where your data lands | Telemetry is stored “in Amazon Web Services (AWS), Microsoft Azure, or Google Cloud data centers,” all offshore — so a mainland user's personal data crosses the border the moment it is collected. |
| Cross-border rule | That export is a transfer of personal information PIPL governs: notice, separate consent and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). |
| Data residency | For a CIIO or large-volume handler, personal information collected in China must stay in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a duty an offshore Dynatrace region cannot meet. |
| Is it reachable? | Yes. Reachability is the delivery half of the question; it is not what decides whether you may lawfully use Dynatrace for mainland users. |
Reachable, but that was never the test
Dynatrace is not the kind of service China blocks outright, and the monitoring agent it injects into your pages will generally report back from mainland browsers. That is the delivery half of the question, and it is the half that settles nothing here. What settles it is that every one of those beacons carries personal data to a region outside China. Reading a populated dashboard as proof that Dynatrace “works in China” mistakes reachability for compliance — the two are different questions, and only the second one carries legal weight.
What Dynatrace captures — and why PIPL treats it as personal data
Dynatrace is explicit about what it collects. In its own documentation it “may capture end-user data, potentially including personal and confidential information about your end users,” and in request monitoring “URLs, client IPs, and certain HTTP header fields are captured automatically.” Switch on Session Replay and it goes further, recording “all HTML source code” along with interactions “obtained through form fields, attributes, content, and interactions such as mouse movement and scrolling.” A client IP address is itself personal information under China’s Personal Information Protection Law, and form-field content and on-screen captures can be far more sensitive than that. So the data flowing from your mainland users to Dynatrace is regulated personal information, not anonymous metrics — and that single fact is what every downstream rule hangs on.
Where that data lands — offshore, with no mainland region
Dynatrace SaaS stores what it collects “in Amazon Web Services (AWS), Microsoft Azure, or Google Cloud data centers,” and the regions it publishes run from N. Virginia and Oregon through Ireland, Frankfurt, London and Tel Aviv to Singapore, Tokyo, Mumbai and Sydney — with nothing inside mainland China. Monitor Chinese users from any of them and their personal information leaves the country the moment the first beacon fires. Under the Personal Information Protection Law that is a cross-border transfer, and the handler — you, not Dynatrace — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore Dynatrace region can satisfy. Dynatrace’s masking controls can shrink what you capture, but they do not change the country the remainder is stored in.
One more door you may already owe: the site itself
Dynatrace rides inside a website, and that website — if it serves the mainland public — carries its own filing obligation quite apart from any monitoring tool. A public-facing site delivered to users in China turns on an ICP filing under State Council Order No. 292 and MIIT Order No. 33. Dynatrace neither creates that duty nor can discharge it; it simply layers a second, data-residency question on top of it. Keeping the two straight — the host site’s ICP filing and Dynatrace’s cross-border data flow — is usually where a sober China-readiness review begins.
This is a risk map, not a verdict: how much exposure you carry turns on what Dynatrace captures for you, how much of it, and whose data it is — worth settling with counsel before you rely on it.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Dynatrace. What we add is the piece an offshore observability platform cannot: compliant, ICP-filed delivery from inside the mainland, set in front of the origin you already run — no rebuild, no second codebase, and no move off your monitoring stack. Our China team maps the two obligations Dynatrace leaves on your side — the host site’s ICP filing and the PIPL cross-border and data-residency exposure your telemetry creates — then stands up the in-country delivery and storage a lawful China presence needs, while Dynatrace stays exactly where it is.
Related reading:
Frequently Asked Questions
Is Dynatrace blocked in mainland China?
No — treat reachability as the wrong test here. Dynatrace is an observability platform, not the kind of public service China blocks outright, and the monitoring agent it injects into your pages will generally report from mainland browsers. The compliance exposure is not whether the dashboard populates; it is that every beacon carries your users' personal data — client IPs, user actions, and with Session Replay the content of their screens — to a Dynatrace region outside China. That export, not the latency, is what China's data law governs.
Does masking or anonymizing data in Dynatrace solve the PIPL problem?
Treat it as risk reduction, not a cure, and confirm the line with counsel. Masking limits what Dynatrace captures, stores and shows, which is worth doing — but the remaining personal data is still stored in an offshore region, so a cross-border transfer still needs a lawful basis under PIPL, and client IP addresses are themselves personal information. Masking also does nothing for a data-localization duty: if you are a CIIO or large-volume handler, the data has to sit inside the mainland, which an offshore Dynatrace region cannot do.
Can 21YunBox help us keep using Dynatrace in China?
Yes. Our China team can map the two obligations Dynatrace leaves on your side — your host site's ICP filing and the PIPL cross-border and data-residency exposure your telemetry creates — for your entity, data volumes and users, and stand up the ICP-filed, in-country delivery and storage a compliant China presence requires, on top of the monitoring stack you already run. Get in touch to work through your specific case.
