Industrial Policy & Trade Monitor· 2666 actions· ✨ 90 recent

Hong Kong enacted the Inland Revenue (Amendment) (Minimum Tax for Multinational Enterprise Groups) Ordinance 2025 (Ordinance No. 21 of 2025), gazetted on 6 June 2025 after the Legislative Council passed the Bill on 28 May 2025. The Ordinance inserts Part 4AA and Schedules 61–64 into the Inland Revenue Ordinance (Cap. 112), implementing the OECD/G20 Pillar Two GloBE rules for MNE groups with consolidated annual revenue ≥ EUR 750 million in at least two of the four preceding fiscal years. It introduces a 15% Income Inclusion Rule (IIR) and the Hong Kong Minimum Top-up Tax (HKMTT) — a Qualified Domestic Minimum Top-up Tax (QDMTT) — effective for fiscal years beginning on or after 1 January 2025; the Undertaxed Profits Rule (UTPR) is deliberately deferred to a date to be specified by gazette notice, completing a structurally phased Pillar Two architecture. IRD estimates additional revenue of approximately HKD 15 billion per year from 2027–28.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

The Investitionskontrollgesetz (InvKG, "Investment Control Act") is Austria's horizontal, statutory FDI screening regime. Published as Article 1 of the Federal Law BGBl. I Nr. 87/2020 on 24 July 2020 and entering into force on 25 July 2020, the Act replaced the previous narrow §§25a–25e Außenwirtschaftsgesetz 2011 (Foreign Trade Act) regime — under which fewer than 10 permits were issued from 2013 to mid-2020 — and transposes EU Regulation 2019/452 establishing a framework for the screening of foreign direct investments into the Union. The InvKG introduces mandatory ex-ante notification and approval of non-EU / non-EEA / non-Swiss acquisitions where the acquirer crosses any of the 10% / 25% / 50% voting-rights thresholds in an Austrian target operating in the critical sectors listed in Annex Part 1 (especially sensitive: defence, energy / water / telecoms critical infrastructure, dual-use technology, cybersecurity, AI, quantum technology, robotics, semiconductors, biotech, health, vaccines) and 25% / 50% in the sectors listed in Annex Part 2 (broader, including media, food-security, electronic communications infrastructure, financial infrastructure). Administered by the Bundesministerium für Arbeit und Wirtschaft (BMAW), with case decisions taken in coordination with the Komitee für Investitionskontrolle (inter-ministerial Investment Control Committee) and, where the case is escalated to the EU cooperation mechanism, the Commission and EU peer Member States. The InvKG is Austria's functional peer of US CFIUS / FIRRMA, UK NSI Act 2021, Germany AWG §§55–62, France Décret 2014-479 / R. 151-1 et seq., Italy Golden Power Decree, Netherlands Wet Vifo, Denmark investeringsscreeningsloven, and Belgium ISC. Sunset clause: originally limited to 30 June 2022 under §17(2) InvKG; permanently extended by BGBl. I Nr. 80/2022 of 14 July 2022.