Does Qualtrics Work in China? Survey Data, PIPL & Data Residency
Qualtrics stores survey responses in its own regional data centers — in the US, the EU and other markets, with none in mainland China — so responses collected from mainland residents cross the border under PIPL, and a foreign-run study can raise a separate survey-licensing question. A compliance-first look at the data-residency door.
Does Qualtrics work in China?
Yes — Qualtrics loads fine in mainland China, but it stores every survey response in its own regional data centers outside the mainland, so collecting answers from Chinese respondents is a cross-border transfer of personal information you have to clear under PIPL.
Qualtrics says it "currently uses the following subprocessors to process personal data in the Cloud Services," naming Amazon Web Services for "Infrastructure / hosting services and storage, including backups" — and the hosting subprocessors it lists carry US and EU addresses, with none in mainland China. So when a mainland resident submits a survey, their personal information is written offshore: a cross-border transfer PIPL governs (notice, separate consent and a transfer mechanism, Articles 38–43), with in-mainland storage required of a CIIO or large-volume handler (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). If a foreign organization is commissioning a market or social survey of mainland residents, China's foreign-related-survey rules may add a separate approval step. The table below is Qualtrics's own wording and the rule each point triggers.
This is a risk map, not a verdict — what you must do turns on your entity, your data volumes and who your respondents are. Our China team can map your exposure with you →
What Qualtrics's own documentation says about China
| Fact | Primary source |
|---|---|
| Qualtrics hosts your survey data on US-based infrastructure, not inside mainland China. In its own subprocessor list Qualtrics says it "currently uses the following subprocessors to process personal data in the Cloud Services," and names Amazon Web Services — listed at "410 Terry Avenue North, Seattle, WA, 98109, USA" — for "Infrastructure / hosting services and storage, including backups." Every hosting subprocessor it publishes carries a US or EU address; none is in mainland China, so a mainland resident's responses are stored offshore — a cross-border transfer under PIPL. | Qualtrics Subprocessors (qualtrics.com/subprocessor-list), retrieved 2026-10-07 |
| Qualtrics confirms its services run in third-party-audited data centers — and publishes no mainland-China one. Its security statement states, "Our services are hosted by trusted data centers that are independently audited using the industry standard SSAE-18 method." Qualtrics operates regional data centers for markets such as the US, the EU and Australia, but offers no standard mainland-China region (inference from its own subprocessor and security documentation) — so responses collected from Chinese respondents land outside the mainland by design. | Qualtrics Security Statement (qualtrics.com/security-statement), retrieved 2026-10-07 |
| A survey answer from a mainland resident is personal information leaving the country. Because Qualtrics stores it offshore, collecting it is a cross-border transfer of personal information under PIPL: as the handler — not Qualtrics — you must give notice, obtain separate consent and satisfy one transfer mechanism (a CAC security assessment, the CAC standard contract, or certification), under Articles 38–43. A critical information infrastructure operator or a large-volume handler must store personal information collected in China inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — which an offshore survey platform cannot do. | China Personal Information Protection Law, Articles 38–43 & 40; Cybersecurity Law Article 39 (formerly Article 37) (gov.cn), retrieved 2026-10-07 |
| If the survey is foreign-run, a separate licensing regime may also apply. China's foreign-related-survey rules (涉外调查管理办法, administered by the National Bureau of Statistics) reach a market or social survey that a foreign organization commissions, funds, cooperates on, or whose results go to a foreign party — a trigger that turns on the foreign relationship itself, not on where the data is stored. So a foreign-commissioned Qualtrics study of mainland residents may need prior qualification or approval on top of PIPL. Treat this as an additional risk to confirm with counsel, not a certainty. | National Bureau of Statistics — Administrative Measures on Foreign-Related Surveys (涉外调查管理办法), stats.gov.cn |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a mainland-China audience, the deciding question about Qualtrics is not how quickly a survey loads — it is where the answers go the moment a respondent hits submit. A survey response is personal information, and Qualtrics keeps it in its own regional data centers; by the company’s own account those run in the United States, the European Union and other markets, but not inside mainland China. So a Qualtrics survey is reachable from the mainland, yet every response a Chinese resident submits is written to storage offshore. That turns running the survey into a cross-border transfer of personal information under Chinese law — and, if a foreign organization is commissioning it, possibly a licensing question as well. Reaching the respondent is the easy half; where their data lands is the exposure.
Qualtrics in China at a glance
| What decides it | In Qualtrics's own terms |
|---|---|
| Where it stores data | Qualtrics hosts its Cloud Services on subprocessor infrastructure — it names Amazon Web Services for “Infrastructure / hosting services and storage” — at US and EU addresses. No hosting subprocessor it lists is in mainland China. |
| A mainland region? | None for standard accounts. Qualtrics runs regional data centers for markets such as the US, the EU and Australia; the nearest to China is still offshore. |
| What a response is | A survey answer from a mainland resident is personal information. Stored offshore, collecting it is a cross-border transfer of personal information PIPL governs. |
| Who carries the duty | The handler — you, the account owner, not Qualtrics — must give notice, obtain separate consent and clear a transfer mechanism; a CIIO or large-volume handler also owes in-country storage. |
| Is it reachable? | Yes — Qualtrics loads from inside the mainland. The exposure here is legal, not a block. |
No mainland data center, so the answers land offshore
Qualtrics is a hosted platform: respondents’ browsers talk to Qualtrics, and Qualtrics writes their answers into its own cloud. In its subprocessor list the company states it “currently uses the following subprocessors to process personal data in the Cloud Services,” and names Amazon Web Services — listed at a Seattle, Washington address — for “Infrastructure / hosting services and storage, including backups.” Every hosting subprocessor it publishes carries a US or EU address, and its security statement adds only that “our services are hosted by trusted data centers that are independently audited using the industry standard SSAE-18 method.” Qualtrics operates regional data centers for markets such as the US, the EU and Australia — but none inside mainland China for a standard account.
That geography settles the data question before performance ever enters it. When a mainland resident completes a survey, their personal information is created in China and written to a Qualtrics data center outside it. “We already use Qualtrics” does not change that: the platform is reachable, but the responses do not stay in the country, and no amount of tuning moves the storage onshore.
Every mainland response is a cross-border transfer under PIPL
Because the answers leave the mainland, China’s Personal Information Protection Law treats the collection as a cross-border transfer of personal information. The handler — you, the account owner, not Qualtrics — has to give notice, obtain separate consent, and clear one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (Articles 38–43). If you are a critical information infrastructure operator or a large-volume handler, personal information collected in China must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore survey platform cannot satisfy. None of this is about whether the survey opens; it is about whether you are cleared to gather the data the way you are gathering it.
A foreign-commissioned survey can raise a second, separate question
One more risk sits outside the data question entirely. If a foreign organization commissions, funds, cooperates on, or receives the results of a market or social survey of mainland-China residents, China’s foreign-related-survey rules (涉外调查管理办法, administered by the National Bureau of Statistics) may require prior qualification or approval — a requirement triggered by the foreign relationship itself, not by where the responses are stored — so a foreign-run Qualtrics study aimed at the mainland is worth clearing with counsel before it goes to field.
This is a risk map, not a verdict: whether you owe notice and separate consent, a transfer mechanism, in-country storage, a survey approval, or several at once turns on what you ask, how much personal data you gather, who your respondents are, and who is paying for the study — worth settling with counsel before fieldwork begins.
Where 21YunBox fits — a compliant overlay, not a migration
You keep running Qualtrics exactly as you do today. What we add is the part a US-hosted survey platform cannot give you on its own: a clear reading of where your respondents’ personal information actually travels, and compliant, ICP-filed delivery from inside the mainland placed in front of the China-facing properties you control — no rebuild, no second codebase, and no migration off Qualtrics. Our China team maps your PIPL cross-border and data-residency obligations against your entity, your data volumes and who your respondents are, flags whether a foreign-commissioned study brings the foreign-related-survey regime into play, and then stands up the in-country delivery and storage a lawful China presence needs — while your survey account stays untouched.
Related reading:
