Industrial Policy & Trade Monitor· 2663 actions· ✨ 89 recent

China's State Council Tariff Commission published its annual "2022 Tariff Adjustment Plan" (税委会〔2021〕18号) on 13 December 2021, effective 1 January 2022. Within the bundled annual schedule, the commission cancelled the 20% provisional preferential export tariff on ferrochrome (HS 72024100/72024900) that had applied since May 2021, reverting it to the standard 40% export rate — a doubling. Ferrosilicon (HS 72022100/72022900) continued at the 25% rate it had already moved to when its own preferential rate was cancelled in May 2021. Both are framed as measures to restrain export of energy- and emissions-intensive primary ferroalloy products and preserve domestic steelmaking input supply.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

The Bureau of Industry and Security added 77 entities (under 78 entries) to the Entity List via a December 22, 2020 final rule (FR Doc 2020-28031). The headline designation is Semiconductor Manufacturing International Corporation (SMIC) — China's largest contract chipmaker — for activities related to military-civil fusion (MCF), with a presumption of denial applied to all items uniquely required to produce chips at advanced nodes of 10 nanometers or below. The batch also covers entities that supported PRC militarisation of artificial islands in the South China Sea and entities implicated in human rights abuses against Uyghurs and other minorities in Xinjiang.

On 15 March 2019, the Second Session of the 13th National People's Congress adopted the Foreign Investment Law of the People's Republic of China (FIL), effective 1 January 2020. The statute replaced the prior tripartite FDI regime — the 1979 Equity Joint Venture Law, the 1986 Wholly Foreign-Owned Enterprise Law, and the 1988 Contractual Joint Venture Law (collectively the "Three Laws") — with a unified legal framework covering all foreign investment in China. The FIL establishes a pre-establishment national treatment plus negative-list regime jointly administered by NDRC and MOFCOM, a Foreign Investment Information Reporting System replacing the former case-by-case approval regime, a national security review mechanism (China's CFIUS equivalent, codified at Art. 35), and Art. 22 technology-transfer prohibition protections. The State Council Implementation Regulations (Order No. 723, promulgated 26 December 2019) entered force on the same date as the FIL.

The Cybersecurity Law of the People's Republic of China (中华人民共和国网络安全法) was adopted at the 24th meeting of the 12th NPC Standing Committee on 7 November 2016 and entered into force on 1 June 2017, establishing the foundational legal framework for network security governance across all sectors. The law creates the Critical Information Infrastructure Operator (CIIO) designation and protection regime administered by the Cyberspace Administration of China (CAC), mandates data localisation for personal information and important data collected or generated by CIIOs in China, and establishes cross-border data-transfer security assessment requirements under Article 37 — the provision later operationalised by DSL 2021, PIPL 2021, and the 2024 CAC Cross-Border Data Flow Provisions. The CSL introduced multi-level protection scheme (等级保护制度 / MLPS) obligations for all network operators and network-product/service security-review procedures, under which CAC triggered the cybersecurity review of Didi Global in 2021 and the exclusion of Micron's products from Chinese critical-infrastructure projects in 2023.