Does IBM Cloud Work in China? Data Residency, ICP & Cross-Border Rules

IBM Cloud is IBM's public cloud — compute, storage and managed services where your users' personal data sits. Its locations list shows no mainland-China region, so a China-facing workload keeps that data offshore under PIPL and can't be ICP-filed. A compliance-first look at residency and cross-border rules.

By the 21YunBox Compliance Team · Reviewed 2026-10-14 · Verified against IBM Cloud's own documentation

Does IBM Cloud work in China?

Whether you can run a China-facing service on IBM Cloud is a data-residency and licensing question, not a speed one. IBM Cloud is where your application's compute, storage and your users' personal data physically sit — and its own locations list has no mainland-China region to deploy into.

With no in-country region, a workload on IBM Cloud keeps your China users' personal data offshore — a cross-border transfer of personal information under PIPL (Articles 38–40) — and a public service hosted outside the mainland cannot hold an ICP filing. Unlike some global clouds, there is no separate IBM Cloud China partition a foreign customer can self-serve, so the data has nowhere in-country to rest, and a CIIO or high-volume handler cannot meet the data-localization duty (CSL Article 39, formerly Article 37) on it. The compliant path is a lawful in-country footing with ICP-filed delivery, stood up in front of the IBM Cloud stack you already run.

This is a risk picture, not a verdict — your duties turn on your entity, your data volumes and your role. Our China team can map your IBM Cloud residency exposure →

What IBM Cloud's own documentation says about China

Fact	Primary source
IBM Cloud's own locations documentation lists no mainland-China region. Under its "Multizone regions," the regions you can deploy into span the Americas, Europe and Asia-Pacific — the nearest to the mainland being Tokyo, Osaka and Chennai — with no Beijing, Shanghai, Shenzhen or Guangzhou location among them. There is no separate IBM Cloud China partition a foreign customer selects and self-serves, so compute and storage provisioned on IBM Cloud keep their data outside mainland China.	IBM Cloud Docs — Locations for resource deployment (Regions and zones), retrieved 2026-10-14
IBM Cloud's data-center footprint is entirely outside mainland China. IBM's own data-centers page lists its locations by country — across North America, Europe, and Asia and Oceania — and none is in mainland China. With no in-country data center or region to deploy into, a workload serving people in China necessarily rests in a location outside the mainland.	IBM — IBM Cloud global data centers (ibm.com/cloud/data-centers), retrieved 2026-10-14
Holding the personal information of people in China on an IBM Cloud region outside the mainland is a cross-border transfer under PIPL Articles 38–40: the handler must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification.	Personal Information Protection Law (PIPL), Articles 38–40 — cross-border provision of personal information
A critical-information-infrastructure operator or high-volume handler must store China personal information on the mainland — PIPL Article 40 and the data-localization rule in Cybersecurity Law Article 39 (formerly Article 37) (the 2025 amendment, in force January 1, 2026, renumbered it from 37 to 39, substance unchanged). An IBM Cloud region outside the mainland structurally cannot meet that in-country storage duty.	China Cybersecurity Law, Article 39 (formerly Article 37); PIPL Article 40 — data localization

Sources verified by the 21YunBox compliance team on 2026-10-14.

For a mainland-China audience, the deciding question about IBM Cloud is not whether a virtual server boots or whether an application can reach it — both are routine. It is where the data that cloud holds is allowed to come to rest, and whether the public-facing service in front of it can be filed. IBM Cloud is IBM’s public cloud — the compute, object storage, databases and managed services where an organization’s application and its users’ personal data physically live. Under China’s Personal Information Protection Law, where that personal data rests, and on what legal basis it may cross a border, is what decides whether you can run a China-facing service on it. IBM Cloud’s own locations documentation lists no mainland-China region to deploy into, so a workload provisioned there keeps that data offshore, and a mainland-facing service on it has no in-country resource to bind an ICP filing to. Unlike some global clouds that run a separate, locally operated China partition, IBM Cloud publishes no mainland-China region a foreign customer can self-serve — so this is a data-residency and licensing question first, not a speed one.

IBM Cloud's own locations documentation showing its multizone regions across the Americas, Europe and Asia-Pacific — with no mainland-China region listed — IBM Cloud's own locations documentation. Under the heading "Multizone regions," the table lists IBM Cloud's regions across the Americas, Europe and Asia-Pacific — Dallas, Washington DC, Toronto, Montreal, São Paulo, Frankfurt, London, Madrid, Tokyo, Osaka, Sydney, Chennai and Mumbai — with no mainland-China region among them. Source: cloud.ibm.com/docs — Locations for resource deployment

IBM Cloud in China at a glance

What decides it	In IBM Cloud's own terms — and China's law
Where the data physically rests (the region reality)	IBM Cloud's published locations list no mainland-China region. Compute, storage and managed services run from regions in the Americas, Europe and Asia-Pacific (nearest Tokyo, Osaka, Chennai, Singapore, Sydney), all outside the mainland. There is no separate IBM Cloud China partition a foreign customer self-serves — so the data rests offshore.
What a cloud platform holds, and why it is personal information	IBM Cloud is where your application's compute, object storage, databases and logs live: customer accounts, orders, transactions, user activity. Most of that is personal information under PIPL, and some — contact, financial and ID fields — is sensitive. Where it rests is a legal question, not a performance one.
Your China users' records when the workload is offshore	Hold the personal information of people in China on an IBM Cloud region outside the mainland and you are making a cross-border transfer under PIPL (Articles 38–40): notice, separate consent, and one transfer mechanism — a CAC security assessment, the standard contract, or certification.
The ICP filing door (备案)	Any public-facing service to mainland users needs an ICP filing tied to a mainland hosting resource. A workload hosted outside the mainland on IBM Cloud has no in-country resource to bind a filing to, so the public service cannot be ICP-filed on it.
The in-country storage duty (CIIO / high-volume handler)	A critical-information-infrastructure operator or high-volume handler must keep China personal information on the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged). A region outside the mainland structurally cannot meet it.
Reachability is not the axis (and the China-facing surface)	Whether IBM Cloud is reachable from China is a delivery matter, not the legal test; data-at-rest residency and filing are. The lawful levers are to place the data that must stay in a lawful in-country footing, and to put the China-facing surfaces that read from it on ICP-filed delivery.

Where the data actually rests

Open IBM Cloud’s locations documentation and the regions you can deploy into span the Americas, Europe and Asia-Pacific — the nearest to the mainland being Tokyo, Osaka, Chennai, Singapore and Sydney — all of them outside mainland China. There is no Beijing, Shanghai, Shenzhen or Guangzhou region on the list.

Nor is there a second door. Some global clouds run a separate, locally operated China partition — a distinct in-country account and operator that keeps data on the mainland. IBM Cloud’s published locations list shows no mainland-China region, and no separate IBM Cloud China partition a foreign customer selects and self-serves. Any China-hosted service offered through a local partner would be a separate, locally operated arrangement, not a region on IBM Cloud’s global locations list. So for a workload you run on IBM Cloud, the data has no in-country region to rest in — it sits offshore.

That is the whole point: the question was never whether the cloud works, but where the data lives and on what legal basis a mainland-facing service runs on top of it.

What it holds is personal information

A public cloud is not a cache or an edge — it is where the application and its data actually live. On IBM Cloud that means the virtual servers, the object storage buckets, the managed databases and the logs: customer accounts, orders, transactions, support history and the identifiers that tie them together. Most of that is personal information under PIPL, and some of it — contact details, financial data, government IDs — is sensitive personal information that draws heightened duties.

That is why residency, not reachability, is the test. When the personal information of people in China rests in an IBM Cloud region outside the mainland, you are making a cross-border transfer, and PIPL Articles 38–40 govern it: notice, separate consent, and one lawful transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. The security-assessment measures set when that assessment is mandatory rather than optional.

On top of the transfer rules sits a harder duty. A critical-information-infrastructure operator or a high-volume handler must store China personal information inside the mainland — PIPL Article 40 and the data-localization rule in Cybersecurity Law Article 39 (formerly Article 37). A region outside the mainland cannot satisfy an in-country storage duty, because the data is, by definition, not in the country.

Why a reachability check misses this

Point a probe at an IBM Cloud endpoint from Shanghai and you can measure a connection — and learn nothing about the question that matters. The workload serves requests just as well from a region outside the mainland; that is precisely the trap. The exposure is not that the cloud is slow or unreachable, it is that the personal information of people in China is sitting outside the country without a lawful basis, that a public service on it cannot be ICP-filed to a mainland resource, and that a CIIO or high-volume handler owes an in-country storage duty an offshore region cannot meet. A speed or uptime test cannot see where data rests or on what legal footing it crossed a border — so it reports “fine” on exactly the cases that carry the most regulatory risk.

The lawful path — map, localize, deliver

21YunBox is a compliant overlay, not a migration — and a partner to IBM and to your platform team, not a competitor to them.

Map. We read the PIPL cross-border, data-residency, data-localization (CII) and ICP obligations against your entity, your data volumes and whose personal information actually sits on IBM Cloud — so you know which duties bite before you move anything.
Localize. For the data the law says must stay in China, we stand up a lawful in-country footing — a licensed in-country or sovereign-cloud deployment on the mainland — and keep consented, in-country storage for what must stay. Because IBM Cloud has no mainland region, localize means standing up a lawful in-country equivalent for that data, not a route back to an offshore endpoint.
Deliver. Any China-facing surface in front of your IBM Cloud workload — the application, the API edge, the admin and reporting portals your mainland users reach — runs over ICP-filed, in-country delivery (the 21YunBox Optimizer), in front of the stack you already run. No rebuild, no second codebase.

This page maps exposure; it is not a legal ruling. Your actual duties turn on your entity, how you classify the data, your transfer volumes and whether you are a critical-information-infrastructure operator — so settle those specifics with qualified China counsel before you rely on any single path. 21YunBox never uses or suggests circumvention of any kind.

Get a compliance assessment →

Frequently Asked Questions

Is there an IBM Cloud region in mainland China?

No. IBM Cloud's own locations documentation lists its regions across the Americas, Europe and Asia-Pacific — the nearest to the mainland being Tokyo, Osaka and Chennai — with no Beijing, Shanghai, Shenzhen or Guangzhou region. And unlike some global clouds that run a separate, locally operated China partition, IBM Cloud publishes no mainland-China region or partition a foreign customer can self-serve, so it cannot host or store your workload in-country.

Is storing our data on IBM Cloud a problem under PIPL?

It can be. Because IBM Cloud has no mainland region, personal information you collect from people in China is kept in a region outside the mainland — a cross-border transfer PIPL permits only with notice, separate consent and one of its transfer mechanisms. Whether you also face a data-localization duty depends on your role (for example, whether you are a CIIO) and your data volume. Treat it as a risk to size with qualified China counsel, not a blanket ban.

Can 21YunBox help run IBM Cloud compliantly in China?

Yes. You keep IBM Cloud as your origin, and our China compliance team assesses your cross-border and data-residency exposure for your entity and data volumes, then stands up the ICP-filed, in-country delivery — and in-country storage where localization applies — that IBM Cloud's out-of-mainland regions cannot provide. Get in touch to work through your specific case.