Does Notion Work in China? Data Residency, PIPL & Cross-Border Risk
Notion is reachable from mainland China in recent in-country tests, but its workspace content and your users' personal data sit on AWS outside the mainland — in the US by default, with no China data region — so serving China turns your team's data into a PIPL-regulated cross-border transfer. A compliance-first look at the real exposure.
Does Notion work in China?
Whether you can use Notion in mainland China is a data-residency question before it is a connectivity one. Even when Notion loads for your China users, where it keeps the personal data they put in is the exposure that matters.
By Notion's own documentation, workspace data is hosted on Amazon Web Services and "by default, your data will continue to reside in the United States"; even Notion's Enterprise data-residency regions are only Oregon, Frankfurt, Tokyo and Seoul — none in mainland China — and Notion warns that "data may be stored in regions outside of the customer's data region." So the names, emails and documents your team enters leave China: that outbound movement is a PIPL-regulated cross-border data transfer, which calls for separate consent, a lawful transfer mechanism, and in-country storage once you are a CIIO or cross the volume thresholds. The table below sets Notion's own wording beside the rules it triggers and the compliant, ICP-filed path that follows.
This is an exposure picture, not a legal verdict — what you owe turns on your data volumes, your role, and how sensitive the content is. Our China team can map your exposure with you →
What Notion's documentation says, and what we measured from inside China
| Fact | Primary source |
|---|---|
| In Notion's own words: it "partners with Amazon Web Services" for data storage, and "by default, your data will continue to reside in the United States." Enterprise data residency can relocate certain data to US-West-2 (Oregon), EU-Central-1 (Frankfurt), AP-Northeast-1 (Tokyo) or AP-Northeast-2 (Seoul) — there is no mainland-China region — and Notion adds that "unless listed above as data stored in the data region, data may be stored in regions outside of the customer's data region." | Notion Help Center — Data residency for Notion, retrieved 2026-10-07 |
| The data Notion keeps in your selected region is the personal-data-bearing content itself: "Page content," "Files (such as images and documents) uploaded to Notion," the "Search index of Customer Data," and "Third-party or bot-generated messages and files." Residency is available only on Notion's "Enterprise Plan" and must be requested through an account team — on every other plan the workspace stays in the United States. | Notion Help Center — Data residency for Notion, retrieved 2026-10-07 |
| Notion already treats moving personal data across borders as a regulated act: it says it will "adhere to the rules for international transfers of personal data outside of the European Economic Area and UK," and its DPA "incorporates both the EU and UK Standard Contractual Clauses." It publishes no comparable China/PIPL transfer mechanism (21YunBox's reading of the same pages) — so for personal data gathered in China, the burden falls on you, the customer. | Notion Help Center — Privacy practices, retrieved 2026-10-07; the mainland-China gap is 21YunBox's inference |
| Under PIPL (Chapter III, Articles 38–43) the handler of that data — the customer, not Notion — must give notice, obtain separate consent for the overseas transfer, and satisfy one CAC mechanism (security assessment, standard contract, or certification). The exposure scales with volume: the CAC's March 2024 rules exempt a non-CIIO moving fewer than 100,000 individuals' non-sensitive personal information in a year, but a CIIO or large-volume handler must store China-collected personal information inside the mainland (CSL Article 39 (formerly Article 37); PIPL Article 40) — and serving that storage lawfully from inside China is the step that triggers an ICP filing. | PIPL Chapter III, Arts. 38–43 & Art. 40; CSL Art. 39 (formerly Art. 37); CAC Regulations on Promoting and Regulating Cross-border Data Flows, March 2024 |
Delivery is the secondary question, and on our own test it was not the blocker: from a probe inside mainland China (Alibaba Cloud cn-zhangjiakou), Notion was reachable and finished loading on all 3 attempts, measured 2026-08-30 — median first byte 1,562ms, median paint 3,460ms. That the page arrives is exactly why the deciding question is legal, not performance. | 21YunBox — 280-site China delivery census, measured from inside mainland China |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the first question about Notion is not whether it loads — recent tests from inside China say it does — but where the personal data your team pours into it is allowed to live. Notion keeps that data on infrastructure outside the mainland, in the United States by default, and offers no China data region at all. So the moment your colleagues in China enter names, emails and documents, those details leave the country, and that outbound movement — not the page load — is what China’s law reaches. The reachability is real; the data residency is the exposure.
Notion in China at a glance
| What decides it | In Notion's own terms |
|---|---|
| Where your data lives | Notion “partners with Amazon Web Services,” and “by default, your data will continue to reside in the United States.” There is no mainland-China location. |
| Data-residency regions | Enterprise-only, by request through an account team: US-West-2 (Oregon), EU-Central-1 (Frankfurt), AP-Northeast-1 (Tokyo), AP-Northeast-2 (Seoul) — no region inside mainland China. On every other plan the workspace stays in the US. |
| What is stored there | The personal-data-bearing content itself: “Page content,” “Files (such as images and documents) uploaded to Notion,” the “Search index of Customer Data,” and “Third-party or bot-generated messages and files.” |
| Cross-border transfer | Personal data entered in China leaves the mainland — a transfer PIPL governs. The handler is you, the customer, not Notion, which publishes no China/PIPL transfer mechanism. |
| Is it reachable? | Yes — reachable and finished loading on all 3 attempts from an Alibaba Cloud cn-zhangjiakou probe on 2026-08-30 (median first byte 1,562 ms, median paint 3,460 ms). Delivery was not the blocker. |
Where your China users’ data actually lives
Notion is explicit about this in its own Data residency documentation. It “partners with Amazon Web Services” to store workspace data, and “by default, your data will continue to reside in the United States.” Residency as a feature exists only on Notion’s “Enterprise Plan” and must be requested through an account team; on every other plan the workspace simply stays in the US. Even when you do turn it on, the only regions Notion offers are US-West-2 (Oregon), EU-Central-1 (Frankfurt), AP-Northeast-1 (Tokyo) and AP-Northeast-2 (Seoul) — not one is in mainland China — and Notion still cautions that “unless listed above as data stored in the data region, data may be stored in regions outside of the customer’s data region.”
What stays in your chosen region is exactly the personal-data-bearing material: “Page content,” “Files (such as images and documents) uploaded to Notion,” the “Search index of Customer Data,” and “Third-party or bot-generated messages and files.” For a China-facing team, that is the names, project notes and uploads your colleagues create every day — all of it resident outside the mainland.
The cross-border transfer is yours to clear, not Notion’s
Notion already treats moving personal data across borders as a regulated act — just not for China. It says it will “adhere to the rules for international transfers of personal data outside of the European Economic Area and UK,” and its data processing addendum “incorporates both the EU and UK Standard Contractual Clauses.” It publishes no comparable China or PIPL transfer mechanism — that gap is 21YunBox’s reading of the same pages — so for the personal information your team gathers in China, the obligation lands on you, the customer, not on Notion.
Under China’s Personal Information Protection Law (Chapter III, Articles 38–43) the handler of that data has to give notice, obtain separate consent for the overseas transfer, and satisfy one CAC mechanism — a security assessment, the CAC standard contract, or certification. The weight scales with volume: the CAC’s March 2024 cross-border rules exempt a non-CIIO that moves fewer than 100,000 individuals’ non-sensitive personal information in a year, but a critical information infrastructure operator or large-volume handler must store China-collected personal information inside the mainland (Cybersecurity Law Article 39 (formerly Article 37); PIPL Article 40). And serving that in-country storage lawfully is the step that turns on an ICP filing.
Reachable, not blocked — which is exactly the point
Delivery is the secondary question here, and on our own measurement it was not the blocker. From a probe inside mainland China — an Alibaba Cloud instance in cn-zhangjiakou, run as part of a 280-site China delivery census — Notion was reachable and finished loading on all three attempts on 2026-08-30, with a median first byte of 1,562 ms and a median paint of 3,460 ms. Its reachability from China has varied over time, so delivery is worth watching — but the fact that the page arrives today is precisely why the deciding question is legal, not performance. A site you can open still leaves your users’ data offshore, and still owes a lawful cross-border transfer.
This is a risk map, not a verdict: whether you face separate-consent and transfer-mechanism duties, in-country storage, an ICP filing, or some combination depends on your data volumes, your role, and how sensitive the content is — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
Your team keeps using Notion exactly as it does today; nothing moves. What Notion does not offer for the mainland — personal-data storage that actually sits inside China, and ICP-filed, in-country delivery of whatever you serve to China users, set in front of your existing origin with no rebuild and no second codebase — is the piece our China team adds. We start by mapping your cross-border and data-residency exposure against your entity, your data volumes, your role, and the sensitivity of what your China users enter, then stand up the compliant, ICP-filed in-country delivery and storage a lawful China presence requires.
Related reading:
