Does SAP S/4HANA Work in China? Data Residency, PIPL Cross-Border & the Onshore Instance

For a company running SAP S/4HANA into mainland China, the first instinct is to ask whether the system is even available there — and it is. S/4HANA is not a service China blocks at the border, and SAP offers ways to run it inside the country: on-premises in your own data center, and on in-China hyperscaler regions operated under Chinese licenses. So availability is not where the China decision is settled. What settles it is data residency — which S/4HANA instance holds your China data, and whether that instance sits inside the mainland or offshore.

That distinction matters more for ERP than for almost any other system, because S/4HANA is the system of record. It holds the crown-jewel business data: finance and controlling, supply chain and procurement, and the master data for your customers, vendors, and employees. Much of that is personal information under Chinese law, and some of it may be classified as “important data.” The moment that data comes to rest in a global, offshore S/4HANA instance, a different body of law decides whether it was allowed to leave.

SAP S/4HANA in China at a glance

Runnable in-country — so residency, not availability, is the question

SAP’s own materials make the in-country option explicit, which is why availability is a dead end for this decision. Its customer data centre option for SAP S/4HANA Cloud Private Edition is marketed squarely on residency: it lets you deploy “even when local hyperscaler options are unavailable,” and ensures “payload data never leaves your physical landscape to satisfy national security and residency mandates,” delivered through infrastructure partners (Dell APEX, HPE GreenLake, Lenovo TruScale). On the public-cloud side, SAP’s May 2025 partnership with Alibaba Group states that “With Alibaba Group as a certified hyperscaler for SAP software workloads, Chinese enterprises will also be able to deploy SAP Cloud ERP and SAP Cloud ERP Private solutions.” (SAP now markets the private and public editions as SAP Cloud ERP Private and SAP Cloud ERP.)

So the real question is not can S/4HANA run in China but does the instance that holds our China data run in China. Many multinationals run a single global S/4HANA instance offshore — in an EU, US, or Singapore hub — and connect their China subsidiary to it. That is precisely the pattern that turns an ERP rollout into a cross-border data question. Where connectivity from the mainland to an offshore instance is slow or inconsistent, the answer is never a network workaround: 21YunBox neither uses nor suggests circumvention of any kind — it is both a compliance risk and beside the point. For the same reason this page publishes no first-party China latency figure for S/4HANA; speed is not the axis on which a residency decision turns.

The data-residency question: an offshore instance is a cross-border transfer

Here is the gate most ERP programs miss. An S/4HANA instance hosted in the EU, the US, or a regional hub outside the mainland is, by definition, offshore. The finance records, HR and payroll data, and customer and vendor master data it holds for your China operations are personal information, and loading them into an offshore instance is a cross-border transfer of personal information under China’s Personal Information Protection Law. PIPL puts the duty on the handler — you, the operating entity, not SAP the vendor: Articles 38–40 require notice, a separate consent distinct from any general employment or customer agreement, and one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification.

Above certain thresholds, or where the ERP data is classified as “important data,” that transfer may also require China’s data-export security assessment (数据出境安全评估) before anything leaves the country. And if your organization is a critical information infrastructure operator, the Cybersecurity Law’s Article 39 (formerly Article 37 — the data-localization provision was renumbered by the 2025 amendment that took effect on January 1, 2026, with its substance unchanged) requires personal information generated in China to be stored in China. None of this turns on how fast a posting runs; it turns on whether the data had a lawful basis to be offshore at all. Which of these bite your specific landscape is a risk to confirm with counsel against what you actually store.

In-country storage, and why “point it at the EU instance” is not the fix

For a CIIO or a large-volume handler, the in-country storage duty under Article 39 (formerly Article 37) is one no offshore instance can satisfy, however it is tuned. Relocating the China data from a US hub to an EU hub does not help — both are outside the mainland, so it merely moves the cross-border transfer, it does not end it. Keeping China-collected ERP data in-country means the instance of record for that data sits inside the mainland: a China-resident S/4HANA deployment — an in-China cloud region or an on-premises customer-data-center landscape — with only what may lawfully leave flowing to your global instance. That split — what must stay, what may go — is the heart of the work, and it is a legal question before it is a technical one.

The China-facing front-ends are their own door

One more door sits on top of the ERP core. S/4HANA by itself is a back-office system, but the web front-ends built on it are often public-facing: a supplier-onboarding portal, a customer self-service or commerce front-end, an employee or applicant portal, a Fiori launchpad exposed to the public internet. Any such service actually served to the public in the mainland is “internet information service,” and that triggers an ICP filing (备案) bound to a mainland hosting resource, plus compliant in-country delivery. The ERP core may be internal; the China-facing surfaces on top of it are a public-service question in their own right.

None of this is a verdict that S/4HANA is “blocked” or “illegal” in China — it runs there, lawfully, when the pieces line up. It is a residency-and-exposure map: which path fits turns on your entity, the data your landscape holds, your role under Chinese law, and who your users are — worth settling with counsel before your China operations depend on it.

The lawful path — map, localize, deliver

There is a compliant way to run SAP S/4HANA for a China operation, and it has a shape. First, map: our China team works through where your China data lives today and where Chinese law needs it to live — which finance, HR, procurement, and master-data records collected in the mainland must stay in-country, what may lawfully flow to your global instance, where a data-export security assessment or an Article 39 (formerly Article 37) storage duty bites, and what your notice and consent has to cover. The legal conclusions are settled with counsel; we build the technical picture that feeds them.

Then localize: we stand up or keep a China-resident S/4HANA instance for the China data — on an in-China cloud region or an on-premises landscape — so the system of record for the mainland sits inside the mainland, while your global instance keeps serving your other markets. Where a domestic ERP is the better fit for a China-scoped process, we integrate a China-legal option — the well-established domestic platforms here are Yonyou (用友) and Kingdee (金蝶) — rather than forcing offshore software to carry data it should not hold.

Then deliver: the China-facing access to that instance — the portals and launchpad your users actually open — is a public service in the mainland, so it carries an ICP filing duty and needs compliant, in-country delivery. 21YunBox delivers it in-country — the 21YunBox Optimizer — in front of what you already run, with no rebuild and no re-platform. The result is an SAP landscape that runs legally and compliantly for your users in China. What we never do — and what no one lawfully can — is hand you a way around China’s data-export rules or around any network restriction: we localize what must stay and deliver in-country, and we never move personal information out of the mainland by stealth.

Get a compliance assessment →

Related reading:

• Cross-border data transfers under PIPL
• China’s data-export security assessment
• China’s Cybersecurity Law (data localization, Article 39)
• How to get an ICP filing for China

RELATED TECHNOLOGIES

Microsoft Dynamics 365 Finance

Microsoft Dynamics 365 Finance

Oracle NetSuite

Oracle NetSuite

Oracle Fusion Cloud ERP

Oracle Fusion Cloud ERP