Does Microsoft SQL Server Work in China? Data Residency, ICP & Cross-Border Rules
Microsoft SQL Server is your system of record — it holds your China users' personal data at rest, so compliance turns on where it runs, not on latency. SQL Server is self-hostable on in-country infrastructure, and Microsoft also offers it through the Azure China sovereign cloud operated by 21Vianet; run it offshore and that data is a PIPL cross-border transfer. A compliance-first look at where your data lives.
Does Microsoft SQL Server work in China?
SQL Server answers from Shanghai just fine — but reachability was never the question. SQL Server is your system of record: it holds your customer and user data at rest, so the only thing that decides China compliance is where that data physically lives. Because SQL Server is software you install yourself, you can run it on in-country infrastructure, and Microsoft also offers it through the Azure China sovereign cloud operated by 21Vianet — two genuine in-country paths.
Keep the database offshore and your Chinese users' personal information rests abroad — a cross-border transfer PIPL governs (notice, separate consent and a transfer mechanism), and for a CIIO or high-volume handler, data the law says must stay in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)). The lever is not a faster route to an offshore server; it is running the engine in-country so the regulated data is stored where the law allows.
This is a risk map, not a verdict — whether you owe in-country storage, a transfer mechanism, or both turns on your data, your volumes and whose it is. Our China team can map your exposure with you →
What Microsoft SQL Server's own documentation says about China
| Fact | Primary source |
|---|---|
| SQL Server is software you install and run yourself. Microsoft's SQL Server Installation Guide is, in its own words, “an index of content that provides guidance for installing SQL Server on Windows,” with setup run from media that “could be either on a network share, a mapped drive, a local drive, or presented as an ISO to a virtual machine.” Because you deploy the engine onto your own physical or virtual machine, you — not a cloud region menu — choose where the data physically lives, including on in-country infrastructure. | Microsoft — SQL Server Installation Guide (learn.microsoft.com), retrieved 2026-10-12 |
| Microsoft also offers SQL Server through a sovereign, in-country cloud. Microsoft describes Microsoft Azure operated by 21Vianet as “a physically separated instance of cloud services located in China,” one “independently operated and transacted by Shanghai Blue Cloud Technology Co., Ltd. (21Vianet).” Its Azure SQL Database region-availability list names the China East 2, China North 2, China East 3 and China North 3 regions — an in-country managed path built on the SQL Server engine — though this sovereign cloud is a separate account under a Chinese operator with a stated “feature parity gap” against global Azure. | Microsoft — Microsoft Azure in China (overview-operations) and Azure SQL Database region availability (docs.azure.cn), retrieved 2026-10-12 |
| Storing China users' personal data offshore is a cross-border transfer. Under the Personal Information Protection Law, holding personal information collected in the mainland on an offshore database is a cross-border transfer: the handler must give notice, obtain separate consent, and clear one transfer mechanism — a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). | PIPL Articles 38–43 (gov.cn), via 21YunBox gov-doc summary |
| Some handlers must store the data in the mainland. A critical information infrastructure operator, or a handler processing personal information above the regulated volume thresholds, must store China-collected personal information inside the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged). An offshore SQL Server deployment cannot meet that duty; an in-country one can. | PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) (gov.cn) |
Sources verified by the 21YunBox compliance team on 2026-10-12.
For a mainland-China audience, the real question about Microsoft SQL Server is not whether a query returns or how fast it does — it is where the data inside it is allowed to come to rest. SQL Server is your system of record: it holds your application’s customer records, user accounts, orders and transactions, and the personal information of your Chinese users among them. And unlike a managed cloud database tied to a provider’s region menu, SQL Server is software you install yourself, so you decide where it runs. That is the compliance lever: you can run SQL Server on in-country infrastructure, and Microsoft also offers it through a sovereign, in-country cloud — Microsoft Azure operated by 21Vianet. The endpoint answering is the easy half; where the data is stored is the half the law turns on.
Microsoft SQL Server in China at a glance
| What decides it | In Microsoft's own terms — and China's law |
|---|---|
| Where the data physically rests | SQL Server stores your records on the machine you install it on — not on a vendor region menu. Run the engine offshore and the data rests abroad; run it on in-country infrastructure and it rests in China. With SQL Server, that is your decision to make. |
| What it holds, and why it's personal information | SQL Server is the system of record on the Microsoft SQL engine — customer records, user accounts, orders and transactions — so the personal information of people in China physically comes to rest inside it. |
| Your China users' records, kept offshore | Held in an offshore database, your Chinese users' personal information is a cross-border transfer PIPL governs (Articles 38–43) — kept in a place China's law treats as outside the country it was collected in. |
| The in-country storage duty | A critical information infrastructure operator or large-volume handler must store China-collected personal information in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37) — the 2025 amendment, in force January 1, 2026, renumbered the data-localization article from 37 to 39, substance unchanged). An offshore deployment cannot meet it; an in-country one can. |
| Two genuine in-country paths | Self-host the engine on in-mainland infrastructure, or use the Azure China sovereign cloud — “Microsoft Azure operated by 21Vianet,” which Microsoft calls “a physically separated instance of cloud services located in China.” Reachability is the delivery half, not the legal half. |
You choose where SQL Server runs — so you can keep the data in China
The feature that makes SQL Server different from a managed-only cloud database is also what makes it compliant-ready: you install and run it yourself. Microsoft’s SQL Server Installation Guide is, in its own words, “an index of content that provides guidance for installing SQL Server on Windows,” and it is set up from installation media that “could be either on a network share, a mapped drive, a local drive, or presented as an ISO to a virtual machine.” In other words, SQL Server comes to rest on the physical or virtual machine you put it on. Point that machine at in-country infrastructure and your database — and the personal information inside it — stays on Chinese soil by construction. The residency question for SQL Server is therefore not “is there a China region?” but “did we deploy it in China?”
The sovereign in-country option: Azure operated by 21Vianet
If you want a managed path rather than a self-hosted one, Microsoft offers the SQL Server engine through a separate, in-country sovereign cloud. Microsoft describes “Microsoft Azure operated by 21Vianet” as “a physically separated instance of cloud services located in China,” one “independently operated and transacted by Shanghai Blue Cloud Technology Co., Ltd. (“21Vianet”).” Microsoft’s Azure SQL Database region-availability list names the in-country regions China East 2, China North 2, China East 3 and China North 3 — an in-country managed path built on the SQL Server engine. This is a real option, not a route back to an offshore endpoint, but it is not a toggle on your existing subscription: it is a separate account under a Chinese operator, on separate endpoints, with its own ICP and compliance footing and, in Microsoft’s words, a “feature parity gap” against global Azure. “We already run on Azure” does not carry across that line — but the in-country path genuinely exists.
What SQL Server holds is personal information
SQL Server is not a cache or an edge in front of your data — it is your data. As the system of record, it holds your customer records, user accounts, orders and transactions, which for a China-facing product means the personal information of people in the mainland. Keep that database in an offshore location and, under China’s Personal Information Protection Law, you are making a cross-border transfer: the handler — you, not Microsoft — must give notice, obtain separate consent, and clear one transfer mechanism, whether a CAC security assessment, the CAC standard contract, or certification (PIPL Articles 38–43). And if you are a critical information infrastructure operator, or you process personal information above the regulators’ volume thresholds, that data must be stored in the mainland (PIPL Article 40; Cybersecurity Law Article 39 (formerly Article 37)) — a residency duty an offshore SQL Server deployment has no way to meet.
Why a reachability check misses the real question
A mainland app can open a connection to an offshore SQL Server and run queries against it, so a reachability or latency test will report “works.” But reachability is the delivery half, not the legal half. The violation a connection test can never see is that the regulated data is stored offshore: a mainland-hosted application pointed at an offshore database moves personal information across the border on every read and write, and an offshore instance can hold neither an in-country copy of the data a localization duty demands nor the ICP-filed footing a public mainland surface needs (State Council Order No. 292; MIIT Order No. 33). Making the offshore database merely reachable does not answer the question; storing the data in-country does.
This is a risk map, not a verdict: whether you owe a transfer mechanism, in-country storage, or both depends on the data you hold, your volumes, and whose it is — worth settling with counsel before you build.
The lawful path — map, localize, deliver
You keep Microsoft SQL Server as your database. What 21YunBox adds is the compliance layer it was never meant to provide on its own, arranged around the stack you already run — no rebuild, no second codebase, no migration off SQL Server.
- Map. Our China team reads your PIPL cross-border, data-residency and data-localization (CII) obligations, and any ICP duty, against your entity, your data volumes, and whose personal information sits in the database.
- Localize. Where the law requires your China users’ data to stay on the mainland, we help you run the database in-country — self-hosted on in-mainland infrastructure or on a licensed sovereign option — and keep consented, in-country storage for what must stay. Localize means an in-country database, not a route back to an offshore endpoint.
- Deliver. Any China-facing surface in front of the database — the app, the API edge, the admin or reporting portal your mainland users reach — runs over ICP-filed, in-country delivery (the 21YunBox Optimizer), in front of the stack you already have.
The result runs legally and compliantly for your users in China. 21YunBox never uses or suggests circumvention of any kind. We are a compliant overlay and a partner to Microsoft, not a competitor and not a migration.
Related reading:
- China’s Personal Information Protection Law (PIPL)
- Cross-border data transfers under PIPL
- China’s Cybersecurity Law and data localization
- How to get an ICP filing for China
