international jurisdictions Archives - Zasio

Record Keeping and Information Governance in China: Jurisdiction Overview

Zasio — Tue, 14 Apr 2026 13:26:33 +0000

Navigating Record Keeping and Information Governance in China

China is recognized for having one of the most intricate and strictly regulated record keeping environments worldwide. Leveraging Zasio’s comprehensive jurisdictional research, organizations are provided with clear and defensible guidance on how archival, privacy, cybersecurity, and data governance requirements interact within the People’s Republic of China (PRC).

Why China Requires Specialized Record Keeping Insight

China’s legal and regulatory landscape is defined by centralized enforcement, extensive administrative controls, and a heightened focus on state supervision and data sovereignty. Record keeping obligations are not isolated; they are deeply integrated with national security concerns, privacy protections, and sector-specific regulatory oversight.

Key jurisdictional characteristics include:

- Civil law system with robust administrative regulation and centralized enforcement
- Mandarin Chinese as the main language for legal and governmental matters
- Strict archival and retention requirements established by national and sector-specific regulators

Zasio’s China Research at a Glance

Zasio’s research on China is tailored for organizations seeking defensibility, precise compliance, and practical application across global operations.

Research scope and depth:

- - 1,836 China-specific record keeping citations captured
  - Coverage anchored in authoritative, subscription-based legal research sources
  - Direct analysis of national laws such as the Archives Law, Personal Information Protection Law (PIPL), Data Security Law, and Cybersecurity Law
  - Review of State Council regulations, Cyberspace Administration of China (CAC) rules, and sector-specific administrative guidance

This research delves beyond basic summaries, identifying enforceable requirements that affect retention periods, data storage locations, and protection measures.

Core Record Keeping Obligations in China

Zasio’s research provides clear, citation-backed requirements for retention across essential record categories.

Accounting and financial records:

- - General accounting records are typically retained for 10 years or 30 years
  - Key financial reports and select high-value records require permanent retention under the Administrative Measures on Accounting Records

Personnel and employment records:

Employers must retain personnel records for at least two years after termination in accordance with the PRC Labor Contract Law.

Archival classifications:

Official archival rules often mandate retention for 10 years, 30 years, or permanently, depending on the record type and its archival significance.

Industries Most Impacted

China’s record keeping and information governance rules are widely applicable, but they are particularly stringent in highly regulated sectors.

Industries most affected include:

- - Life sciences and pharmaceuticals
  - Technology and internet platforms
  - Financial services
  - Manufacturing and telecommunications

Multinational organizations in these industries often encounter additional complexity due to data localization and cross-border data transfer requirements.

What Makes China Uniquely Challenging

China distinguishes itself globally by requiring organizations to balance multiple, occasionally conflicting regulatory objectives.

Notable complexities include:

- - Legal mandates for long-term or permanent archival retention alongside privacy minimization and deletion requirements
  - Overlapping and sometimes competing obligations across archival, privacy, cybersecurity, and sector-specific regimes
  - Rigid data localization demands that significantly impact multinational business models

China’s evolving governance of artificial intelligence, algorithms, and automated decision-making adds further complexity. These new regulations increasingly link record retention and auditability to AI oversight and compliance.

Business Relevance for Global Organizations

China’s regulatory influence extends far beyond its borders. Organizations may be subject to Chinese regulations even when processing data outside the country, provided the data pertains to individuals or activities within China.

Organizations most affected include:

- - Multinational enterprises
  - Pharmaceutical and life sciences companies
  - Technology, SaaS, and AI-driven platforms
  - Companies with cross-border data flows involving China

How Zasio’s Research Supports Defensible Compliance

Zasio’s jurisdictional research assists organizations in developing information governance strategies that withstand regulatory scrutiny.

Clients use this research to:

- - Holistically map retention, privacy, data security, and archival obligations
  - Lower regulatory and enforcement risk through clear, citation-backed requirements
  - Synchronize records retention schedules with privacy and cybersecurity controls
  - Enable defensible technology configurations and data lifecycle decisions across global operations

China Record Keeping in One Sentence

China is one of the most complex record keeping jurisdictions globally. Zasio’s research captures over 1,800 enforceable requirements to help organizations confidently navigate overlapping archiving, privacy, data security, and AI governance obligations.

Disclaimer: The purpose of this post is to provide general education on information governance topics. The statements are informational only and do not constitute legal advice. Any references to legal or regulatory recordkeeping requirements are provided for general guidance purposes and may not reflect all obligations applicable to your organization. Additional or alternative requirements may apply based on your organization’s industry, jurisdiction, risk profile, and specific business activities. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

The post Record Keeping and Information Governance in China: Jurisdiction Overview appeared first on Zasio.

Navigating Multiple Jurisdictional Requirements: Which Jurisdiction is Controlling for Retention Purposes?

Zasio — Mon, 04 Nov 2019 20:02:14 +0000

A common question amongst our international clients is: “which jurisdictional law should our retention schedule follow?” From a records management perspective, the general rule of thumb is to focus on the “place of the regulated activity.” Applying this rule can be difficult, however, when there are regulated activities with legal and operational implications beyond the borders in which the activity takes place. This becomes an issue in particular when retention requirements between jurisdictions that use the same types of record vary greatly in the retention periods. Of course, there are exceptions to every general rule, and this guidance must be qualified with an “it depends…”

Limited Place of Regulated Activity

The simplest approach is to follow requirements across jurisdictions while addressing outliers on a country-by-country basis. This method assumes the adoption of a global baseline which generally covers retention requirements across jurisdictions. The country-exception is then reserved for outliers to the global baseline retention period. Deciding to implement a country-exception is appropriate where a country has a retention requirement that is significantly longer or shorter than the other jurisdictions. This approach is most fitting to address records related to a regulated activity that takes place strictly within national borders. Generally, this includes the vast majority of company’s regulated records — think employee records, time and attendance records, national income tax, payroll records, etc.

Regulated Activities with Implications Across Borders

For records related to activities with broader cross-border implications, an alternative approach is to adopt the most stringent requirement from among the multiple jurisdictions considered. This is most appropriate where the place of regulated activity is not limited to a jurisdiction, as is often the case with product manufacturing and distribution, and particularly true of pharmaceutical drug and device manufacturing.

To illustrate difficulties in determining a controlling jurisdiction for retention requirement purposes, consider the following scenario:

Your Company manufactures products in jurisdiction A, but distributes its products in jurisdictions A, B, and C. The manufacturing records from jurisdiction A now reach across other jurisdictions, as jurisdictions B and C also have their own manufacturing quality standards and retention requirements in relation to products authorized for marketing and distribution within their borders. If jurisdiction A requires manufacturing quality records to be maintained for 5 years, jurisdiction B requires 10 years, and C requires 15 years for the same records, then which jurisdiction is controlling for retention period purposes?

Under a scenario similar to the foregoing, one must decide whether to follow the 5, 10, or 15-year requirement for the Company’s quality manufacturing record series. This is not a decision to be taken lightly, as there is a big difference between 5 and 15 years. Deciding either way carries potential risks and costs associated with over-retention or under-retention of records. In making this decision, one should consider the following factors:

Do manufacturing standards in A satisfy the standards in Jurisdictions B and C?
Will Jurisdiction A’s quality records be subject to similar audits and inspections as those required in Jurisdictions B and C?
Are there Mutual Recognition Agreements between any of the jurisdictions recognizing the quality standards of one another?
Are there cross-jurisdictional reach considerations during investigations regarding the production of records?
How does the Company’s risk profile guide the appropriate course of action?

In addition to these factors, any other considerations unique or pertinent to your Company should also be reviewed. Information gathered from stakeholders and record-owners will also be helpful for this analysis as well. These individuals are most knowledgeable about the records and can provide information regarding audit and inspection standards across jurisdictions, including any unwritten rules surrounding recordkeeping requirements. Finally, it is important to gather feedback from legal and privacy professionals while determining an appropriate harmonized or country-specific retention period. Through proper information gathering and analysis of jurisdictional activities and requirements you can arrive at a balanced strategy that addresses overlapping recordkeeping requirements while still staying agile, streamlined, and compliant.

If you would like more information, or need help navigating multiple jurisdictional requirements for your company, contact Zasio.

Disclaimer: The purpose of this post is to provide general education on Information Governance topics. The statements are informational only and do not constitute legal advice. If you have specific questions regarding the application of the law to your business activities, you should seek the advice of your legal counsel.

Author: Jennifer Chadband, IGP, CRM, ECMp

Senior Analyst / Licensed Attorney

The post Navigating Multiple Jurisdictional Requirements: Which Jurisdiction is Controlling for Retention Purposes? appeared first on Zasio.

Inside Consulting: Simplifying, Harmonizing, and Maintaining Retention Schedules

Zasio — Wed, 03 May 2017 19:21:11 +0000

We’re excited to highlight some of the recent engagements of our Consulting Division and the ways we’re using our expertise, resources, and thought-leadership to serve our clients and communities as we advance the practice of records management and information governance.

Retention Schedule Maintenance

Our experience and reputation in drafting and updating retention schedules continues to earn the trust of our clients. This is reflected by our numerous ongoing maintenance relationships, many of which extend back more than a decade. Recently, we completed a refresh of retention schedules for clients in multiple industries, including oil and gas, manufacturing, pharmaceuticals, and financial services. This work encompassed legal research in the United States, Canada, the European Union, China, India, and many others, totaling over 30 unique international jurisdictions.

During our refresh efforts, we validated legacy retention citations to ensure they remain current and legally valid, conducted research to discover relevant newly-enacted laws, and provided recommendations to adjust retention periods to meet minimum legal standards while improving efficiency and ease of use.

Retention Schedule Development

Retention schedules are the linchpin of a sound and legally defensible records management program. Each retention schedule must be designed to provide robust coverage of business operations while keeping simplicity in mind. This serves two purposes: to encourage adoption and to foster a culture of adherence within the organization.

During a recent client restructuring effort, we conducted interviews with key stakeholders to identify records and merge multiple retention schedules into one functional and process-oriented retention schedule. This helped make implementation of the schedule across departments easier. When we wrapped up the project, the restructuring effort resulted in a more efficient retention schedule that reduced the number of record codes from nearly 100 down to 45, a reduction of over 50%.

In addition, we assisted a company specializing in the emerging field of Internet of Things (IoT) with the initial phase in the development of its company-wide retention schedule. Although regulation of the IoT industry is still in its early stages, we provided a flexible records retention schedule that will enable them to adapt to a dynamic regulatory environment in the future.

Global Harmonization

A unified records retention schedule eases the administrative burdens for large multinational companies that conduct operations in numerous international jurisdictions. A global financial institution sought our guidance on the consolidation of multiple jurisdictional schedules into a single, harmonized schedule, as well as help to identify potential hurdles. This required analysis of the shortest compliant retention period for each country where they operate. We then synthesized this information into recommendations to integrate and harmonize the client’s retention periods between all their jurisdictions with an eye to lower global retention periods while keeping the number of country-specific exceptions to a minimum. This was to help prepare the client for the roll-out of their international consolidation efforts.

Mergers and Acquisitions

The merger of two or more separate companies or business units can present a daunting task for records managers. Seeking to unify the two disparate systems often creates significant pain points concerning compatibility, file structure, and naming conventions. An international credit agency recently sought our advice on building a retention schedule to cover all its existing operations and business divisions, including those recently acquired. We interviewed stakeholders at various business units within the company and merged the diverse records into a single, unified records retention schedule, using domestic and international research to validate and streamline their retention schedule.

Expert Guidance

Records managers continually face new challenges presented by new information technologies, formats, and platforms. We have been a thought leader in the information governance space for over a decade. A client recently asked for our assistance to design a policy to manage unstructured data. We created a report that contained best-practice guidelines and considerations necessary for the planning and development of an unstructured data management policy. The report included guidance and sample policies, as well as specific unstructured data policy considerations tailored to email and electronic messages, shared drives, and SharePoint. This gave the client a foundation on which to build their program and policies.

Contact Zasio today to see how our host of software solutions and consulting services can help you stay complaint with your data retention policies and practices.

The post Inside Consulting: Simplifying, Harmonizing, and Maintaining Retention Schedules appeared first on Zasio.