How to Choose a Local Subsidiary Setup for Confidentiality Controls

Who this guide is for

This guide is for buyers who are comparing ways to deliver services in another country through an owned local entity — a professional services firm opening an offshore support subsidiary, a software company standing up a regional delivery centre, or a group consolidating work that used to be handled by third-party contractors. The selection question is narrow but consequential: which ownership, scope and control arrangement gives you defensible confidentiality for client information, without paying for protection you do not need?

It is a selection guide, not legal advice. Entity formation, licensing, tax and data-transfer obligations vary by jurisdiction and change often; the criteria below tell you what to define and what to ask, not what your particular answer will be.

Requirements to define before you look at options

Confidentiality specifications are only meaningful against a defined workload. Fix these five points in writing before comparing structures:

1. What information the subsidiary will actually touch. Separate (a) client-identifying data, (b) client-owned business data such as files, drawings, source code or case material, (c) your own commercial information (fees, margins, pipeline), and (d) staff employment data. Each category usually has different owners, different rules and different transfer routes.
2. Where the data physically and legally sits. A subsidiary can be incorporated in Country B, employ staff in Country C and host systems in Country D. Confidentiality exposure follows the data, not the incorporation certificate.
3. Whether the client must consent. In several regulated service sectors, outsourcing to an affiliated entity outside the client's jurisdiction triggers disclosure or consent duties under professional conduct rules, even where the affiliate is wholly owned. Confirm this per client contract and per regulator rather than assuming a group relationship is treated as internal.
4. Who the subsidiary serves. An entity that serves group companies only is a different compliance animal from one that contracts directly with external clients and needs its own licences, insurance and, in some jurisdictions, minimum capital.
5. Retention and exit. How long information stays, and how it is returned or destroyed if the subsidiary is closed, sold or converted into a different entity type.

Selection criteria that actually distinguish setups

1. Legal separateness versus operational integration

A subsidiary is a separate legal person. That separateness is a confidentiality tool: it creates a defined perimeter around information, a clear accountable officer and a lawful basis for imposing contractual duties on the entity that employs the staff. It is also a cost: the information boundary must be managed deliberately, because shared group systems quietly dissolve it. Score setups on whether the perimeter is enforceable — can you direct the subsidiary's staff to keep client information from group marketing, group IT or group sales functions?

2. Contractual chain completeness

The confidentiality promise needs to run end-to-end: client → your contracting entity → the subsidiary → individual staff and any sub-contractors. Gaps usually sit in the middle (a group services agreement drafted for cost allocation, silent on client data) or at the end (employment contracts with generic confidentiality language that does not name client categories or post-employment duties). Where personal data is involved, the client-facing instrument typically has to contain the mandatory processor terms of the applicable data protection regime; under the EU GDPR, Article 28(3) requires a written contract covering documented instructions, confidentiality of authorised personnel, security measures, sub-processor conditions, assistance with data subject rights, breach notification, deletion or return and audit. A subsidiary setup that cannot flow those terms down automatically is a weaker choice than one built around a standard processing schedule.

3. Transfer route and its documentation burden

Cross-border transfer rules are the criterion most often underestimated at selection stage. They determine whether your structure needs a filing, a contract, a certification or an assessment — and therefore whether the subsidiary can go live on schedule. Two anchor points:

• China outbound. The Cyberspace Administration of China's Provisions on Facilitating and Regulating Cross-border Data Flow, effective 22 March 2024, set thresholds: non-sensitive personal information concerning fewer than 100,000 individuals (cumulative since 1 January of the current year) is exempt from security assessment, standard-contract filing and certification; 100,000 to 1,000,000 individuals generally requires standard-contract filing or certification; 1,000,000 or more individuals in total, or 10,000 or more individuals' sensitive personal information, generally requires a security assessment. Exemptions also exist for transfers necessary to perform a contract with the individual and similar scenarios, but they are fact-specific — treat the thresholds as the planning baseline and confirm the current text before relying on any exemption.
• EU/EEA outbound. Sending personal data from an EU entity to a subsidiary outside the EEA still needs a Chapter V transfer mechanism (adequacy decision, standard contractual clauses, or another Article 46 tool) plus the Article 28 processing terms. Ownership does not create an intra-group exemption.

Ask each candidate structure: which route would this design need, and what is the realistic lead time to put it in place?

4. Entity type and activity scope

Formation choices constrain confidentiality indirectly through governance. A wholly foreign-owned limited liability company, a branch, or a joint venture differ in who can be compelled to disclose information, who controls banking and payroll records, and how easily the entity can be closed. In China, the revised Company Law took effect on 1 July 2024 and changed several governance mechanics for existing foreign-invested entities; if the subsidiary is in a jurisdiction with a recent company-law overhaul, put the transition obligations on your selection checklist, because a structure that needs re-papering within a year is not the low-effort option it appears to be. Also check whether the intended scope of business (for example, providing IT or consulting services to third parties) needs a separate filing or licence — an entity that cannot lawfully take the work will not be able to honour the confidentiality commitment either.

5. Access, segregation and monitoring

Confidentiality is delivered by controls, not by clauses. Evaluate the setup on: role-based access with named requesters; logging that can answer "who opened this client file, when, and from where"; physical or logical separation between client environments; clean-desk and device rules where staff work in shared or home environments; and a defined escalation path for suspected disclosure. A subsidiary under shared group identity management will usually need extra work to reach the same standard as a standalone entity.

6. People-side controls

Individual obligations are where confidentiality most often fails quietly: named confidentiality undertakings in employment contracts, onboarding and annual refresher training tied to specific client categories, exit interviews that confirm return of material, and clarity on whether staff may be seconded to client sites. Ask how many staff the subsidiary expects at steady state and how training is funded — an entity sized on the assumption of "a few people" often grows past the controls designed for it.

7. Audit rights and accountability ownership

Pick the structure that gives your client-facing entity, or your client directly, contractual audit rights over the subsidiary and a named person accountable for confidentiality. If the subsidiary reports only to a regional finance function, expect confidentiality questions to travel slowly.

Decision path

Questions to put to advisers and suppliers

• Which transfer route would this specific design require, and what evidence do you rely on for the thresholds?
• What exactly does the intra-group agreement say about client information, and does it flow the mandatory processing terms down to the subsidiary?
• Who is the accountable person for confidentiality in the subsidiary, and to whom do they report?
• Can the subsidiary's staff be instructed to withhold information from group functions, and is that instruction documented?
• What are the formation, licensing and transition obligations this year, and what do they cost to maintain?
• How would a client audit the subsidiary, and what would they be shown?
• What is the exit plan: return or destruction of client information, and closure or sale of the entity?

Limitations

Thresholds and filing requirements change, and their application depends on facts this guide cannot see — the nature of the data, the sector, the client's own regulatory position and the jurisdictions involved. Sector-specific professional conduct rules on outsourcing and client consent vary by regulator and are not uniform. Nothing here should be read as a statement of current law in any particular jurisdiction; verify the operative text and take local advice before committing to a structure.

Sources

• Regulation (EU) 2016/679 (GDPR), Article 28 (processor) and Chapter V (transfers) — official text on EUR-Lex.
• Cyberspace Administration of China, Provisions on Facilitating and Regulating Cross-border Data Flow, effective 22 March 2024 — thresholds for security assessment, standard-contract filing and certification, and exemptions.
• American Bar Association, Formal Opinion 08-451 (2008) on lawyer obligations when outsourcing legal and non-legal support services, including supervision and client communication duties.
• Company Law of the People's Republic of China, revised version effective 1 July 2024 — governance and transition points relevant to foreign-invested entities.