Does Qlik Work in China? Data Residency, Localization & PIPL Cross-Border
Qlik comes in two shapes, and for a China-facing deployment the deciding question isn't dashboard speed — it's where the data rests. Qlik Cloud is vendor-hosted SaaS with no mainland-China region, so loading China data into it is a PIPL cross-border transfer; Qlik Sense Enterprise Client-Managed is self-hosted and can run in-country. A compliance-first look at Qlik's regions, residency, and PIPL / Cybersecurity Law localization.
Does Qlik work in China?
Yes — Qlik runs in China, but the deciding question is data residency, not speed, and the answer depends on which edition you run.
Qlik ships in two shapes. Qlik Cloud is the vendor-hosted SaaS; its tenants reside only in offshore AWS regions — the United States, Canada, Europe, the Middle East, Brazil, and Asia-Pacific markets — with no mainland-China region, and Qlik's regions page states it hosts your data only in the region you select. Qlik Sense Enterprise Client-Managed is self-hosted software you install on infrastructure you control, which can be inside mainland China. Because Qlik's associative engine loads and extracts source data into memory, a Qlik deployment concentrates personal information — so loading mainland-China data into an offshore Qlik Cloud tenant is a PIPL cross-border transfer, and for a critical-information-infrastructure operator it collides with the in-country storage duty in the Cybersecurity Law Article 39 (formerly Article 37). The data-resident path keeps the loaded data in-country: a self-hosted Client-Managed site inside the mainland, with the dashboards delivered in-country.
21YunBox maps your data flows and cross-border exposure, localizes the footing so the data and extracts stay in the mainland, and delivers the China-facing dashboards in-country — no rebuild, no moving data across the border; we never use or suggest circumvention. Treat the specifics as a risk to confirm with counsel. Our China team can map your exposure →
What Qlik's own documentation says about China
| Fact | Primary source |
|---|---|
| Qlik Cloud is hosted only in the regions you select — none in mainland China. Qlik's regions page states that “Qlik Cloud is available in multiple geographies globally supporting the varied data residency, sovereignty and regulatory needs of our customers,” and that “we host your data only in the region you select.” The regions listed span the United States, Canada, Europe, the Middle East, Brazil, and the Asia-Pacific markets of Tokyo, Singapore, Sydney, and Mumbai — mainland China does not appear. | Qlik, “See Qlik Cloud Regions” (qlik.com/us/regions), retrieved 2026-10-10 |
| Qlik Sense Enterprise Client-Managed is self-hosted — you run it on infrastructure you control. Qlik's administrator documentation states that “Using Qlik Sense Enterprise on Windows, you can continue to deploy on-premise and in the cloud,” and that it can be deployed “on-premise, in a private cloud” as well as in Qlik's hosted cloud. Because you choose where a Client-Managed site runs, it can be deployed on infrastructure inside mainland China — keeping the loaded data and extracts in-country. | Qlik Help, “Introducing Qlik Sense Enterprise” (help.qlik.com), retrieved 2026-10-10 |
| Sending China-collected personal information offshore is a cross-border transfer under PIPL. Articles 38–40 require a handler moving personal information outside the mainland to give notice, obtain a separate consent, and satisfy one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. Loading mainland-China data into an offshore Qlik Cloud tenant is such a transfer. | Personal Information Protection Law of the PRC, Articles 38–40 (cac.gov.cn), retrieved 2026-10-10 |
| Data collected by a CII operator in China must be stored in China. China's Cybersecurity Law requires that personal information and important data collected and generated by critical-information-infrastructure operators within the mainland be stored within the territory — the data-localization duty at Article 39 (formerly Article 37, renumbered by the 2025 amendment effective January 1, 2026). An offshore analytics cloud with no China region structurally cannot meet it. | Cybersecurity Law of the PRC, Article 39 (formerly Article 37) (cac.gov.cn), retrieved 2026-10-10 |
Sources verified by the 21YunBox compliance team on 2026-10-10.
For a mainland-China audience, the first question about Qlik is not whether a dashboard renders quickly — Qlik is generally reachable from the mainland — but where the data behind that dashboard is allowed to come to rest. Qlik’s associative engine is an in-memory engine: it loads data out of your source systems and holds it, building extracts, app data files, and cached result sets. A Qlik deployment is therefore one of the larger single concentrations of personal information a business keeps — customer records, user accounts, transactions, employee data. And Qlik ships in two shapes that sit on opposite sides of the residency line. Qlik Cloud is the vendor-hosted SaaS, and its tenants reside only in offshore AWS regions, with no mainland-China region. Qlik Sense Enterprise Client-Managed is self-hosted software you install on infrastructure you control — which can be inside mainland China. So “does Qlik work in China?” is really two questions with two answers, and both turn on data residency rather than milliseconds.
Qlik in China at a glance
| What decides it | In Qlik's own terms — and China's law |
|---|---|
| What it is | Two shapes under one name. Qlik Cloud is the vendor-hosted SaaS — the associative in-memory engine running in Qlik's offshore AWS regions, with the data it loads resident there. Qlik Sense Enterprise Client-Managed is self-managed software you install and run on your own infrastructure (physical hardware or VMs), on-premise or in a cloud you administer. |
| Is Qlik Cloud hosted in China? | No. Qlik's regions page lists its tenants across the United States, Canada, Europe, the Middle East, Brazil, and Asia-Pacific markets (Tokyo, Singapore, Sydney, Mumbai) — no mainland-China region — and states that "we host your data only in the region you select." |
| Loading China data into Qlik Cloud | Qlik's engine loads and extracts your source data into the tenant. If that tenant is offshore, placing mainland-China personal information in it is a cross-border transfer under PIPL (Articles 38–40): notice, a separate consent, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. |
| Residency for CII & important data | The Cybersecurity Law Article 39 (formerly Article 37) and PIPL Article 40 require critical-information-infrastructure operators and high-volume handlers to store personal information and important data collected in the mainland inside the mainland — a duty an offshore Qlik Cloud tenant cannot meet. |
| The data-resident path | Run Qlik Sense Enterprise Client-Managed on infrastructure inside China (or a licensed in-country option), keep the loaded data and extracts resident, and deliver the China-facing dashboards in-country on ICP-filed infrastructure. 21YunBox maps the data flows, localizes the footing, and delivers the app in the mainland — it never moves your data across the border. |
Where the data actually rests
Qlik Cloud’s hosting is set by Qlik’s own infrastructure, not by a load-time test from Shanghai. When a tenant is created, an administrator selects a region, and Qlik’s regions page is explicit that the data stays in that choice: it states that “we host your data only in the region you select.” The regions it offers span the United States, Canada, Europe (Dublin, London, Frankfurt, Paris, Sweden), the Middle East (UAE, Tel Aviv), Brazil (Sao Paulo), and the Asia-Pacific markets of Tokyo, Singapore, Sydney, and Mumbai. As of this review (retrieved October 10, 2026) mainland China is not on that list; the nearest options are Tokyo and Singapore — both offshore.
That is why the familiar “does it load from Shanghai?” question misses the point for Qlik. Qlik Cloud is generally reachable from the mainland, so speed is rarely the blocker — and for that reason this page publishes no first-party China latency figure for Qlik: a number without the data-residency context would answer the wrong question. What actually decides whether you can use Qlik for a China-facing audience is where the data it holds is allowed to live. And because Qlik’s associative engine is an in-memory engine — it loads data out of your source systems and holds it, building extracts, app data files, and cached result sets — the data does not merely pass through: it comes to rest inside the tenant’s region. If that region is offshore, so is the data.
What it holds is personal information
A Qlik app is only as local as the data loaded beneath it. The associative engine pulls from every connected source — customer records, order histories, support tickets, employee data — and concentrates it into one place, which makes a Qlik deployment frequently one of the largest single stores of personal information a company keeps. When the people behind those records are in China and the Qlik Cloud tenant is offshore, loading that data into Qlik is a cross-border transfer of personal information under China’s Personal Information Protection Law. PIPL puts the duty on the handler — you, the business, not Qlik: Articles 38–40 require notice, a separate consent distinct from any general terms, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification.
How heavy that duty is tracks your role and your volumes, not the act of switching Qlik on. A smaller flow of non-sensitive personal information by a non-CIIO can be exempt from the three formal mechanisms, while sensitive data, higher volumes, or “important data” can pull in a mandatory data-export security assessment run by the CAC — and because a BI platform concentrates data, it can be what pushes a handler over the volume threshold that triggers those duties. For some operators the question is not “transfer lawfully” but “do not transfer at all”: China’s Cybersecurity Law requires that personal information and important data collected and generated by critical-information-infrastructure operators within the mainland be stored within the territory — the data-localization duty at Article 39 (formerly Article 37, renumbered by the 2025 Cybersecurity Law amendment in force January 1, 2026, substance unchanged). PIPL Article 40 carries an in-country storage duty for CIIOs and large-volume handlers as well.
Running it on a no-China-region managed service doesn’t meet the residency duty — and what does
Where a data-localization duty applies, an offshore Qlik Cloud tenant is structurally the wrong place for the underlying data: there is no mainland-China region to localize it in, so the duty cannot be met by configuration. The lawful move starts from Qlik’s second shape. Qlik Sense Enterprise Client-Managed is self-hosted: Qlik’s administrator documentation says that with it “you can continue to deploy on-premise and in the cloud,” and that you can run it “on-premise, in a private cloud” as well as in Qlik’s own hosted cloud. Because you choose the infrastructure, you can stand a Client-Managed site up inside the mainland — with its app data, extracts, and loaded models resident there, fed by a China-resident data store. Do that and the analytics layer stops being a cross-border transfer: the data and the dashboards both stay on Chinese soil. Keeping the loaded data in-country is the move an offshore Qlik Cloud tenant cannot make — and it is not a migration, it is simply running Qlik where the data already lives.
None of this is a ruling. Whether your operation is a critical-information-infrastructure operator, whether what you hold counts as “important data,” and which transfer mechanism (if any) your flows require are determinations to settle with counsel against what you actually load into Qlik — this page maps the exposure, it does not resolve it.
The lawful path — map, localize, deliver
Underneath the edition choice sits the part 21YunBox owns, and it is more than advice. The China-facing dashboards and embedded views that surface Qlik are themselves a public service in the mainland, so they carry an ICP filing (备案) duty and need compliant, in-country delivery like any other China-facing property. Our China team does three things on that footing. We map your data flows — which sources Qlik loads, what personal information the extracts and app data hold, and your PIPL cross-border and data-residency exposure. We localize the footing — standing up a self-hosted Qlik Sense Enterprise Client-Managed site (or a licensed in-country / sovereign option) on infrastructure inside the mainland, so the loaded data and extracts never leave the country; localize here means running Qlik in-country, not reaching back to an offshore tenant. And we deliver the China-facing dashboards in-country on ICP-filed infrastructure — the 21YunBox Optimizer — set in front of the stack you already run, with no rebuild and no second codebase.
The result is a Qlik deployment that is responsive for users in China and sits on the resident side of the border. 21YunBox is a compliant overlay, not a migration, and a partner to Qlik, not a competitor. What we do not do is move your data across that border to make it work, and 21YunBox never uses or suggests circumvention of any kind. The outcome we aim for is simple: Qlik that runs legally and compliantly for your users in China.
Related reading:
- Cross-border data transfers under PIPL
- China’s data-export security assessment measures
- China’s Cybersecurity Law — data localization at Article 39 (formerly Article 37)
- ICP filing for China-facing websites
