Does Medallia Work in China? PIPL, Data Residency & Where Survey Data Lives
Medallia runs no region inside mainland China — it processes survey and feedback responses in the US and other countries under the Data Privacy Framework — so your China respondents' personal data is a cross-border transfer PIPL governs, with the controller duty on you, not Medallia. A compliance-first look at where survey data lives.
Does Medallia work in China?
Whether you can use Medallia in mainland China is first a cross-border-transfer and data-residency question, not a speed one. Medallia is an experience-management platform — it collects the survey and feedback responses, and the personal data inside them, that your brand gathers — and where that data is processed is what China's law responds to.
By Medallia's own Global Privacy Policy, for data collected through the Medallia Experience Cloud "the customer (i.e., bank, etc.) is the controller and their privacy policy governs," and Medallia is the processor — so the PIPL duty for your China respondents' data sits with you, not Medallia. And Medallia says it "may transfer and process personal data in the United States and in other countries," relying on the US Data Privacy Framework, with no mainland-China region named. So responses from your China users are held offshore: a cross-border transfer PIPL governs, needing notice, separate consent and a transfer mechanism — and, for a CIIO or large-volume handler, in-country storage. The table below is Medallia's own wording and the rules it triggers.
This is a risk picture, not a verdict — your obligations turn on your data volumes and your role. Our China team can map your Medallia exposure with you →
What Medallia's own documentation says about China
| Fact | Primary source |
|---|---|
| In Medallia's own words: for data collected through the Medallia Experience Cloud, "the customer (i.e., bank, etc.) is the controller and their privacy policy governs," and Medallia processes it "only on their instructions" as a processor. So for the survey and feedback responses your brand gathers from users in China, you are the personal-information handler under PIPL — the cross-border duty is yours, not Medallia's. | Medallia — Global Privacy Policy (Processor Role), effective 2026-09-30, retrieved 2026-10-08 |
| Medallia's Global Privacy Policy states it "may transfer and process personal data in the United States and in other countries where we, our affiliates, or our service providers operate," and that for transfers into the US it relies on its certification under the EU-U.S., UK and Swiss Data Privacy Framework. No mainland-China region is named, so the responses you collect from your China users are held offshore. | Medallia — Global Privacy Policy (International Data Transfers), retrieved 2026-10-08 |
| Because those responses leave China, PIPL governs the cross-border transfer: the handler must give notice, obtain separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. | PIPL Chapter III, Articles 38–43 |
| The exposure scales with volume and role, not merely with using the tool: under the CAC's March 2024 cross-border rules, a non-CIIO transferring fewer than 100,000 individuals' non-sensitive personal information in a calendar year is exempt from the security assessment, standard contract and certification. | CAC — Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
| For a CIIO or large-volume handler, personal information collected in China must be stored inside mainland China (PIPL Article 40; CSL Article 37). Medallia publishes no mainland-China region, so keeping your China respondents' data on Chinese soil means running that collection and storage on infrastructure inside the mainland — which is where an ICP filing enters the picture. | PIPL Article 40; CSL Article 37; Medallia — Global Privacy Policy, retrieved 2026-10-08 |
Sources verified by the 21YunBox compliance team on 2026-10-08.
For a mainland-China audience, the deciding question about Medallia is not how quickly a survey paints — it is who is responsible for the responses it collects and where those responses are allowed to live. Medallia is an experience-management platform: it gathers survey and feedback responses, and the personal data inside them, on infrastructure outside mainland China. Medallia answers both parts in its own Global Privacy Policy. For the data your brand collects through the platform, Medallia says its customer — you — is the controller, and it may transfer and process that data in the United States and other countries. So the data crosses the border, and the duty to clear that crossing under China’s law is yours.
Medallia in China at a glance
| What decides it | In Medallia's own terms |
|---|---|
| Where it runs | Offshore. Medallia's privacy policy says it may process personal data “in the United States and in other countries where we, our affiliates, or our service providers operate,” and for US transfers it relies on the EU-U.S., UK and Swiss Data Privacy Framework. No mainland-China region is named. |
| Who is the controller | For data collected through the Medallia Experience Cloud, Medallia says “the customer (i.e., bank, etc.) is the controller and their privacy policy governs”; Medallia acts as processor on your instructions. The PIPL handler duty sits with you. |
| Your respondents' data | Personal data inside your China respondents' survey answers is processed offshore — a cross-border transfer PIPL governs, needing notice, separate consent and one transfer mechanism. |
| Data residency | No mainland-China storage option is published. A CIIO or large-volume handler owes in-country storage (PIPL Art. 40; CSL Art. 37) that offshore processing cannot meet. |
| Reachability | The platform and its survey widgets are served from offshore. Whether a survey paints fast or slow is a delivery matter — separate from whether the border crossing is cleared. |
For survey data, the controller is you — so the PIPL duty is yours
Medallia draws a clear line in its Global Privacy Policy. For the responses collected through the Medallia Experience Cloud, it says “the customer (i.e., bank, etc.) is the controller and their privacy policy governs,” and that it processes that data “only on their instructions” as a processor. In China’s terms, that makes your brand — not Medallia — the personal-information handler for every survey and feedback response you gather from users in the mainland. So the obligations that attach to that data are yours to meet, and “Medallia handles privacy” does not transfer them away from you. Reaching respondents is not the same as being cleared to collect and move their data.
Your China respondents’ data is processed offshore
Medallia is “a global company headquartered in the United States,” and in its own words it “may transfer and process personal data in the United States and in other countries where we, our affiliates, or our service providers operate.” For transfers into the United States it relies on its certification under the EU-U.S., UK and Swiss Data Privacy Framework. Not one mainland-China region appears in that policy, so the survey responses you collect from Chinese users are processed and stored outside the mainland.
Under China’s Personal Information Protection Law that is a cross-border transfer, and the handler — you, as the controller of the responses — must give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty no offshore region can satisfy, and the point at which standing up lawful in-country collection brings an ICP filing into view.
This is a risk map, not a verdict: whether you owe a transfer mechanism, in-country storage, or both turns on what you collect, how much personal data you hold, and who your respondents are — worth settling with counsel before you build.
Reachable or not, every response still crosses the border
Medallia’s platform and the survey widgets it serves load from offshore. Whether a given survey paints quickly or slowly for a respondent in China is a delivery question — and a real one — but it is not the question that decides whether you may use it. Even a survey that opens instantly still sends the response, and the personal data inside it, out of the mainland to Medallia’s offshore infrastructure. That crossing is the exposure, and tuning the network does not close it; only where the data is collected and stored does.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running your Medallia programs. We add the piece an offshore platform cannot: compliant, ICP-filed delivery from inside the mainland, set in front of your existing stack — no rebuild, no second codebase, and no move off Medallia. Our China team maps your PIPL cross-border and data-residency obligations against your entity and the volume of responses you collect, then stands up the in-country delivery and, where the law requires your China respondents’ data to stay on the mainland, the in-country storage a lawful China presence needs.
Related reading:
