CyphrQ
Menu

Chinese AI Data Security: What the Laws and Privacy Policies Say

China's AI rules, PIPL and Data Security Law, what DeepSeek, Kimi and Alibaba Cloud say about data location, and the questions to ask first.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

11 min read

Chinese AI data security comes down to two questions: where your prompts are stored, and which law governs them there. DeepSeek's and Kimi's consumer privacy policies say personal data is stored in the People's Republic of China. Alibaba Cloud lets API customers pick a storage region. An open-weight model run on your own servers sends nothing to the vendor at all.

This guide is for businesses outside China. It covers the rules, three providers' own documents, how regulators abroad reacted, and what to ask before signing up.

What rules do Chinese AI companies work under?

Three texts matter most: the generative AI Interim Measures, the Personal Information Protection Law (PIPL) and the Data Security Law (DSL).

What do China's generative AI Interim Measures require?

The Interim Measures for the Management of Generative AI Services were issued by the Cyberspace Administration of China (CAC) and six other agencies on 10 July 2023, and took effect on 15 August 2023 (Article 24). The quotes below are this post's own translation of the official Chinese text on cac.gov.cn.

  • Scope (Article 2). The Measures cover generative AI services offered to the public in mainland China. Research and development by companies and institutions that don't offer the service to the domestic public is excluded.
  • Content (Article 4). Providers and users must adhere to the core socialist values and must not generate content the law prohibits. The same article asks for measures against discrimination and for more transparent, accurate services.
  • Training data (Article 7). Training data and base models must come from lawful sources, must not infringe intellectual property, and personal information needs consent or another legal basis.
  • Your prompts (Article 11). Providers must protect users' input information and usage records. They may not collect personal information that isn't necessary, may not unlawfully retain inputs and records that can identify the user, and may not unlawfully provide them to others.
  • Assessment and filing (Article 17). Services with "public opinion attributes or social mobilisation capacity" must pass a security assessment and file their algorithms.
  • Services from abroad (Article 20). If a service offered from outside mainland China to users inside it doesn't comply, the CAC notifies other bodies to take "technical and other necessary measures".

For a business outside China, Article 11 is the useful one. It limits what a provider may do with prompts, but the limit is "unlawfully". What a provider must hand over sits in the two laws below.

How do China's PIPL and Data Security Law affect data held by AI providers?

Both laws are quoted from Stanford DigiChina's English translations, not official texts. The PIPL, translated by Rogier Creemers and Graham Webster:

  • Article 3 reaches processing outside China when the purpose is "to provide products or services to natural persons inside the borders". If your business sells to people in China, this can apply to you.
  • Article 38 gives three routes for sending personal information abroad: a state security assessment, a "personal information protection certification", or a standard contract with the overseas recipient.
  • Article 40 requires critical information infrastructure operators, and handlers above state-set volume thresholds, to store personal information collected in China domestically.
  • Article 41 bars handing domestically stored personal information to foreign judicial or law enforcement bodies without approval from the competent Chinese authorities.
  • Article 66 sets fines of up to 1 million yuan, and in grave cases up to 50 million yuan or 5% of annual revenue.

The Data Security Law, in force since 1 September 2021 (Article 55):

  • Article 21 sets up a graded classification system, with "important data" and "core national data" under stricter management.
  • Article 31 places exports of important data under the Cybersecurity Law for critical infrastructure operators, and under rules to be set by the authorities for everyone else.
  • Article 35 lets public security and state security authorities obtain data for national security or criminal investigations under strict approval procedures, and says organisations and individuals "shall cooperate".
  • Article 36 says data stored in mainland China may not go to foreign judicial or law enforcement bodies "without the approval of the competent authorities of the PRC".

Put together: data held in China sits under Chinese law for both access and disclosure. That doesn't make it unsafe. It does mean your contract can't override those rules, and your own regulators may ask how you assessed them. The CAC has issued further cross-border rules under these laws that this post doesn't cover.

Where do DeepSeek, Kimi and Alibaba Cloud say they store your data?

The table uses one document per provider, read on 25 October 2026, and names the kind of document. Baidu's policy couldn't be read for this post, so Baidu isn't covered.

Provider (alphabetical) Document read Where data is stored Training on your content
Alibaba Cloud (Qwen models) Model Studio region guide, updated 13 October 2026 The region you choose sets "access point and data storage location". Regions include China (Beijing), Singapore, Germany (Frankfurt), Japan (Tokyo), China (Hong Kong) and US (Virginia) Not stated on this page
DeepSeek Privacy policy, last updated 10 February 2026 "We directly collect, process and store your Personal Data in People's Republic of China" Inputs may be used to train models; the policy gives a right to opt out
Moonshot (Kimi) Kimi privacy policy, effective 31 August 2026 "We store your personal information within the territory of the People's Republic of China" De-identified inputs and outputs may be used "to optimize our models"; opt out through customer service

Three details are worth knowing:

  • DeepSeek names Hangzhou DeepSeek Artificial Intelligence Co., Ltd. as the company behind the policy. It keeps account data, including inputs, "for as long as you have an account", and may share data to comply with "legal process or government requests". It has a section for the EEA, Switzerland and the UK, and names Prighter Group as its EU and UK representative.
  • Kimi's policy names Beijing Moonshot Technology Co., Ltd., cites the PIPL and the Data Security Law, and states "we will not provide any of your personal information outside China" without separate consent and compliance with national rules. Only this version was reviewed, so check which entity and policy your own contract names.
  • Alibaba Cloud says "your static data always remains in the selected region".

The pattern: consumer apps store in China, while the cloud API lets you choose. A region choice is a setting, not proof. Our GCC data residency guide covers how to check one.

How have regulators outside China responded to Chinese AI apps?

DeepSeek is the case with public regulator decisions. Italy's data protection authority, the Garante, ordered a definitive limitation of processing of data of people in Italy on 30 January 2025. Its grounds included transparency, legal basis, storage in China and the lack of an EU representative. South Korea's PIPC announced on 17 February 2025 that DeepSeek had paused its service in Korea at the PIPC's recommendation.

The full detail, and the separate database exposure Wiz Research found, are in our DeepSeek case file. Both regulators examined the privacy policy, the storage location and local representation, three things you can check yourself.

Is an open-weight Chinese model on your own servers different from the hosted app?

Yes. Some models are published as open weights: the trained files that make up the model, which anyone can download and run.

Hosted app or API Open weights on your own infrastructure
Where prompts go The provider's servers, in the region its policy or your settings name Your servers only, if you block outbound traffic
Law that governs stored prompts The law where the provider stores them Your own jurisdiction
Provider can train on your data Depends on the policy and opt-out No; the provider never sees it
Main risks Data location, retention, legal access Model file integrity, output behaviour, your own hosting security

Self-hosting moves the risk rather than removing it. You secure the server and check the model files you download; our Hugging Face Spaces breach case shows model-hosting platforms can be a weak point. Test the outputs against your use case too: a model from a provider bound by the Interim Measures' content rules (Article 4) may reflect them.

What should you ask before buying a Chinese AI service?

These questions work for any AI vendor. They matter more when data may cross borders.

  1. Which legal entity contracts with us, and in which country? Compare it with the entity named in the privacy policy.
  2. Where are prompts, files and logs stored, and where is inference run? Ask for this in writing, per product.
  3. Is our content used for training, and how is the opt-out applied to an organisation, not just one user?
  4. How long are inputs and logs kept, and can we delete them?
  5. What happens when an authority requests our data, and will you tell us? Ask how the vendor handles the PIPL Article 41 and DSL Article 36 approval rules if your own courts request data.
  6. Who is your representative in our jurisdiction? The Garante treated a missing EU representative as a problem.
  7. Can we run the model ourselves instead? If the weights are open, compare the two options before you choose.

If staff already use these apps without approval, start with our shadow AI guide. For what never goes into any chatbot, see the AI at work privacy checklist. More on governance is under AI Governance.

Going deeper: for security and IT teams

Legal identifiers for your risk register. Record clauses by number so legal and security teams read the same text: Interim Measures Articles 2, 11, 17 and 20 (CAC); PIPL Articles 3, 38, 40, 41, 53 (local representative) and 66 (DigiChina); DSL Articles 21, 31, 35 and 36 (DigiChina).

Data flow and trust boundary. With a hosted app, the trust boundary is the provider's API. Everything in the prompt crosses it, including pasted documents, file uploads and tool output from connected systems. With self-hosted weights, the boundary is your own network edge, and you decide storage, retention and jurisdiction.

Threat model. The realistic risks are not exotic: data stored somewhere you didn't assess, kept longer than expected, used for training without an organisation-wide opt-out, subject to access rules your contract can't change, or simply mis-secured by the provider. The last one is documented: the Wiz finding in our DeepSeek case file was an open log database, not a legal access request.

Controls with specifics: Alibaba Cloud Model Studio. Per Alibaba's region guide:

  • Pin the region in code. Region IDs include ap-southeast-1 (Singapore), eu-central-1 (Frankfurt), us-east-1 (Virginia) and cn-beijing (Beijing).
  • Use the workspace domain, {WorkspaceId}.<region>.maas.aliyuncs.com, for production. Alibaba says the DashScope domains won't get new features after 30 September 2026.
  • Because API keys are region-bound, issue keys only in the regions you approved. A key for cn-beijing in your secrets store means someone provisioned that region.
  • Choose a deployment scope with a geographic boundary if your compliance rules require one. Alibaba describes the "Global" scope as offering a "larger inference resource pool".

Controls with specifics: consumer apps. DeepSeek's and Kimi's training opt-outs are per account, which doesn't scale to an organisation. If you allow the apps at all, write the decision into your acceptable use policy and treat prompt content as stored in China.

Controls with specifics: self-hosting. Run the model in a network segment with deny-by-default egress. Log and alert on any outbound connection attempt from the inference host. Record the model's source and file hashes when you download it, and store the files in your own artefact repository.

Detection and evidence. Search proxy and DNS logs for the providers' domains, such as dashscope.aliyuncs.com and cn-beijing.maas.aliyuncs.com for Alibaba's Beijing region. Review your CASB for consumer AI app sign-ins. For self-hosted models, an empty egress log from the inference segment is your evidence that prompts stayed inside.

What to verify. Compare the vendor's written answers to the questions above with its published policy. Where they differ, the published policy is what a regulator will read first.

Learn more

Key takeaways

  • DeepSeek's and Kimi's consumer policies say personal data is stored in the People's Republic of China.
  • Alibaba Cloud's Model Studio lets API customers choose regions, including Singapore, Frankfurt and Virginia, and says static data stays in the chosen region.
  • China's Interim Measures limit what providers do with prompts. The PIPL and Data Security Law govern access to data held in China, including requests from foreign courts.
  • Open-weight models on your own servers keep prompts away from the provider, but you then own the hosting security.
  • Ask every vendor for the contracting entity, storage location, retention, training opt-out and representative in writing.

Sources