IIJ adds China law option to overseas IT survey service

Internet Initiative Japan, or IIJ, has added a China law consulting option to its overseas IT environment assessment service for corporate clients, the company said on September 4, as Japanese headquarters seek greater visibility into data regulation risks at their subsidiaries in China.

The new offering, called the China Law Consulting Option, was added to IIJ Global Onsite Survey Solution and became available on September 4. It is designed to provide an initial assessment of how a client's subsidiary in China is responding to Chinese laws on data security and personal information protection.

Under the service, consultants from IIJ Global Solutions China will examine systems operated by a client's subsidiary in China and determine whether data is transferred across borders. The service also provides a provisional assessment of the subsidiary's classification under China's Multi-Level Protection Scheme for cybersecurity, along with an initial evaluation of risks associated with cross-border transfers of personal information. The initial assessment covers up to five systems.

IIJ said the reports are intended to help headquarters in Japan understand conditions at their local entities and set priorities for action. Consultants familiar with China's local language, regulations and legal framework conduct the review, enabling a client's IT staff to carry out interviews and document checks for the China site without traveling there.

The option focuses on two areas covered by China's so-called three major data laws: the graded cybersecurity protection system under the Cybersecurity Law and requirements under the Personal Information Protection Law. It is available to customers that sign up for the standard plan of the onsite survey service.

The standard plan examines basic items such as firewall policies and internet-line redundancy, while a premium plan covers a broader range of office IT infrastructure and operations, including monitoring, maintenance and backups. According to the release, the China law option combines the standard plan's findings on networks, firewalls and maintenance conditions with an initial review of regulatory compliance.

IIJ launched IIJ Global Onsite Survey Solution in April 2025, dispatching engineers from the IIJ Group to overseas sites to assess IT environments, evaluate security risks and propose improvements. Since the launch, the company said it has received many inquiries from businesses seeking stronger IT governance across their overseas operations, with particularly strong demand related to China.

The company said overseas subsidiaries often operate without dedicated IT staff or rely on local employees and vendors, making it difficult for headquarters in Japan to understand actual conditions. This lack of visibility can turn overseas sites into entry points for cyberattacks, potentially affecting not only the local entity but also business continuity across the wider group and the company's reputation.

China's three major data laws are the Cybersecurity Law, Data Security Law and Personal Information Protection Law. IIJ said violations can result in penalties of up to 1.2 billion yen or 5% of the previous year's sales, as well as business suspension or license revocation. This makes delayed compliance at subsidiaries in China a potentially significant business risk. The reference price for the China law consulting option is 492,000 yen, excluding tax, as of August 2026.

China's data governance regime has become an operational issue for multinational companies that store or transfer data across borders, particularly when subsidiaries in China exchange information with regional or global headquarters.

Originally published on jp.ibtimes.com