Does Smartsheet Work in China? Data Residency, PIPL & Where Your Sheets Live
Smartsheet hosts your data only in the United States, European Union or Australia — it runs no mainland-China region — so the personal data in your China users' sheets sits offshore, a cross-border transfer under PIPL. A compliance-first look at the data-residency door.
Does Smartsheet work in China?
Smartsheet is reachable from mainland China — but that was never the compliance question. Your sheets hold personal data, and Smartsheet stores it in a US, EU or Australia region, never inside the mainland. Serving your China users from there is a cross-border transfer of personal information that PIPL governs.
In Smartsheet's own words, "Smartsheet Regions gives you control over where your account data is hosted: United States (US), European Union (EU), or Australia (AU)," and "You can choose data residency in the United States, the European Union, or Australia." There is no mainland-China region, so the personal information your Chinese users and collaborators put into Smartsheet — names, emails, contact and HR records — leaves the mainland: a cross-border transfer under PIPL (notice, separate consent and a transfer mechanism, Articles 38–43), and for a CIIO or large-volume handler, data the law says must stay in China (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). The table below is Smartsheet's own wording and the rule each row triggers.
This is a risk map, not a verdict — what you owe turns on your entity, your data volumes and who your users are. Our China team can map your exposure and the compliant path with you →
What Smartsheet's own documentation says about China
| Fact | Primary source |
|---|---|
| Smartsheet stores your data in one of three regions — none inside mainland China. In Smartsheet's own words, "Smartsheet Regions gives you control over where your account data is hosted: United States (US), European Union (EU), or Australia (AU)," and "You can choose data residency in the United States, the European Union, or Australia." The United States is the default; there is no mainland-China option, so data from your Chinese users is hosted offshore. | Smartsheet Help Center — Data residency & Introducing Smartsheet Regions (help.smartsheet.com), retrieved 2026-10-07 |
| Your sheets are the exposure, because they hold personal information. Smartsheet treats what your users submit as Customer Content that "is physically hosted in your selected data region," and states that "Each regional instance operates independently, meaning data stays within its region and doesn't move between instances." Work-management and project sheets routinely carry names, emails and contact, HR or customer records — so that personal information lives wherever your region sits, which is never the mainland. | Smartsheet Help Center — Introducing Smartsheet Regions & Data residency (help.smartsheet.com), retrieved 2026-10-07 |
| Serving mainland users from an offshore region is a cross-border transfer under PIPL. Because the data region is in the US, EU or Australia, personal information you collect from Chinese users leaves the mainland. As the handler you must give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification. If you are a critical information infrastructure operator or a large-volume handler, that data must instead be stored inside China — a residency duty none of Smartsheet's three regions can meet. | PIPL Articles 38–43 (cross-border transfer) & Article 40; Cybersecurity Law Article 39 (formerly Article 37); against Smartsheet's published regions, retrieved 2026-10-07 |
| ICP filing enters only if you publish Smartsheet content on a public mainland site. Smartsheet is mainly an internal work tool, so data residency is the primary door, not licensing. But if you surface Smartsheet-published forms, dashboards or WorkApps on a public, mainland-facing website, that site needs an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33 — and content served from an offshore region has no mainland hosting resource to file against. | State Council Order No. 292; MIIT Order No. 33 (ICP regime); against Smartsheet's published regions, retrieved 2026-10-07 |
Sources verified by the 21YunBox compliance team on 2026-10-07.
For a team with people in mainland China, the real question about Smartsheet is not whether it loads — it does — but where the personal data in your sheets is allowed to live. Smartsheet answers that in its own documentation: it hosts customer data in the United States, the European Union or Australia, and runs no region inside mainland China. So the exposure on a China-facing Smartsheet account is not reachability; it is that every name, email and record your Chinese users enter is stored offshore, which turns ordinary project work into a cross-border transfer of personal information under China’s law.
Smartsheet in China at a glance
| What decides it | In Smartsheet's own terms |
|---|---|
| Where your data lives | Three regions — United States (the default), European Union (Frankfurt, Germany) and Australia (Sydney), each on AWS. No region is inside mainland China; your content sits in whichever one you pick. |
| What's in your sheets | Project and work-management data routinely holds personal information — names, emails, contact, HR and customer records — treated as Customer Content that “is physically hosted in your selected data region.” |
| Crossing the border | Serving China users from a US, EU or Australia region makes their personal data a cross-border transfer under PIPL; notice, separate consent and a transfer mechanism fall on you, the handler. |
| In-country storage | A CIIO or large-volume handler must keep China personal data in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — and Smartsheet has no mainland region to hold it. |
| Is it reachable? | Yes — the app loads from offshore AWS. Reachability was never the compliance question; where the data lives is. |
No mainland region, so your sheets live offshore
Smartsheet lets you pick where your account’s data is hosted, but only from a fixed short list. In its own words, “Smartsheet Regions gives you control over where your account data is hosted: United States (US), European Union (EU), or Australia (AU),” and “You can choose data residency in the United States, the European Union, or Australia.” The United States is the default; the EU instance runs on AWS in Frankfurt and the Australian one on AWS in Sydney. There is no fourth option inside mainland China, and the nearest region to your Chinese users is still an ocean away.
That geography is the whole data-residency question. Smartsheet describes everything your users submit as Customer Content that “is physically hosted in your selected data region,” and notes that “each regional instance operates independently, meaning data stays within its region and doesn’t move between instances.” Because none of those regions is in the mainland, the personal data your China teams and collaborators enter — the ordinary contents of a staffing plan, a vendor list, a customer tracker — is stored outside the country by design. “We already use Smartsheet” settles the tool question, not the compliance one.
Your China users’ data crosses the border
Once personal information collected in mainland China is held in a US, EU or Australia region, you have made a cross-border transfer, and China’s Personal Information Protection Law puts the duties on the handler — you, not Smartsheet. You have to give notice, obtain separate consent, and satisfy one transfer mechanism: a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). Those obligations attach to the people whose names sit in your sheets, not to whether the page painted quickly.
If your organization is a critical information infrastructure operator, or handles personal information above the regulatory volume thresholds, the bar is higher still: that data must be stored inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). A residency duty like that cannot be met by a US, EU or Australia region — there is no Smartsheet instance on the right side of the border to hold it. This is the point most “it loads fine for us” checks miss: reachability is a delivery fact, residency is a legal one, and only the second decides whether you may store the data where it currently sits.
When ICP enters — publishing Smartsheet content to the public
For most teams Smartsheet is an internal workspace, so the licensing door stays shut and data residency is the only one that matters. It opens only if you expose Smartsheet to the public: a published form, dashboard or WorkApp embedded in a mainland-facing website turns that site into a public internet information service, which needs an ICP filing (ICP 备案) under State Council Order No. 292 and MIIT Order No. 33. A filing has to attach to a hosting resource physically in the mainland, and content served from an offshore Smartsheet region gives it nothing to attach to. So the ICP question is conditional on how you use Smartsheet — but when it applies, an offshore region cannot answer it either.
This is a risk map, not a verdict: whether you face a cross-border transfer, an in-country storage duty, an ICP filing, or some mix depends on what you store, how much of it is personal data, and who your users are — worth settling with counsel before you build.
Where 21YunBox fits — a compliant overlay, not a migration
Your teams keep working in Smartsheet exactly as they do now. What we add is the piece a SaaS tool hosted only in the US, EU or Australia cannot: a compliant, ICP-filed path to in-country delivery and storage from inside the mainland, placed in front of the setup you already run — no rebuild, no second codebase, and no move off Smartsheet. Our China team reads your obligations against your entity and your data volumes, pins down where personal data may lawfully sit, and stands up the in-mainland delivery a compliant China presence needs, so the legal footing is handled without uprooting how your organization works.
Related reading:
