Industrial Policy & Trade Monitor· 2679 actions· ✨ 92 recent

China's Ministry of Commerce issued Announcement No. 26 of 2026 on June 24, 2026, establishing a formal reporting and handling system for violations of export controls on strategic minerals and dual-use items, effective July 1, 2026. The mechanism opens two reporting channels — a dedicated hotline (010-12369) and an online portal (aqygzj.mofcom.gov.cn) — through which any organisation or individual may report suspected violations including unauthorised exports, circumvention via third-country re-routing, illegal technology transfers, and provision of services to sanctioned exporters. Anonymous reports are accepted; real-name reporters may qualify for monetary rewards; voluntary self-disclosure is treated as a mitigating factor in penalty determination. Service providers including freight forwarders and financial institutions face mandatory reporting obligations when they discover suspected violations in the course of business.

Premier Li Qiang signed State Council Order No. 835 on 13 April 2026 promulgating the "Regulations of the People's Republic of China on Countering Foreign States' Unlawful Extraterritorial Jurisdiction" (20 articles), effective on the date of publication. The Regulations are the first State Council–level administrative regulation to operationalise the PRC's framework for identifying and countering foreign extraterritorial measures on a horizontal basis, complementing the 2021 Anti-Foreign Sanctions Law and the March 2025 AFSL implementation regulations. Article 5 establishes a State Council–led inter-agency coordination mechanism; Article 6 vests the State Council legal affairs department (the Ministry of Justice in practice) with authority to identify "improper" foreign extraterritorial measures and to grant exemptions; Article 8 authorises a new Malicious Entity List targeting foreign organisations and individuals that "promote or participate in implementing" such measures, with nine countermeasure categories spanning visa denial, asset freezing, trade restrictions and fines; Article 11 codifies an exemption-application channel under which Chinese persons facing conflicting legal demands may request approval to comply with foreign measures within a defined scope; Article 14 authorises a private right of action for harmed Chinese citizens and organisations to sue parties enforcing such measures; and Article 18 elevates enforcement beyond administrative penalties by referencing potential criminal liability.

The Cyberspace Administration of China (CAC) issued the Provisions on Promoting and Regulating Cross-Border Data Flows (《促进和规范数据跨境流动规定》) on 22 March 2024, effective immediately. The rules substantially raise the thresholds at which CAC security assessment, Standard Contractual Clauses (SCC), or Personal Information Protection Certification are required for outbound data transfers, and create categorical exemptions for contract performance, HR management, intra-group transfers below a volume threshold, and transit data processed in China with no domestic personal information introduced. A Free Trade Zone pilot mechanism allows designated FTZs (Shanghai Lingang, Tianjin, Beijing) to publish their own negative lists defining which data categories still require prior approval, easing conditions for multinationals with operations in those zones.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

The Cybersecurity Law of the People's Republic of China (中华人民共和国网络安全法) was adopted at the 24th meeting of the 12th NPC Standing Committee on 7 November 2016 and entered into force on 1 June 2017, establishing the foundational legal framework for network security governance across all sectors. The law creates the Critical Information Infrastructure Operator (CIIO) designation and protection regime administered by the Cyberspace Administration of China (CAC), mandates data localisation for personal information and important data collected or generated by CIIOs in China, and establishes cross-border data-transfer security assessment requirements under Article 37 — the provision later operationalised by DSL 2021, PIPL 2021, and the 2024 CAC Cross-Border Data Flow Provisions. The CSL introduced multi-level protection scheme (等级保护制度 / MLPS) obligations for all network operators and network-product/service security-review procedures, under which CAC triggered the cybersecurity review of Didi Global in 2021 and the exclusion of Micron's products from Chinese critical-infrastructure projects in 2023.