Industrial Policy & Trade Monitor· 2667 actions· ✨ 89 recent

China's Ministry of Commerce issued Announcement No. 26 of 2026 on June 24, 2026, establishing a formal reporting and handling system for violations of export controls on strategic minerals and dual-use items, effective July 1, 2026. The mechanism opens two reporting channels — a dedicated hotline (010-12369) and an online portal (aqygzj.mofcom.gov.cn) — through which any organisation or individual may report suspected violations including unauthorised exports, circumvention via third-country re-routing, illegal technology transfers, and provision of services to sanctioned exporters. Anonymous reports are accepted; real-name reporters may qualify for monetary rewards; voluntary self-disclosure is treated as a mitigating factor in penalty determination. Service providers including freight forwarders and financial institutions face mandatory reporting obligations when they discover suspected violations in the course of business.

Premier Li Qiang signed State Council Order No. 839 on 20 May 2026, promulgating the "Regulations for the Implementation of the Mineral Resources Law of the People's Republic of China" (8 chapters, 79 articles), effective 15 June 2026. The Regulations are the primary implementing instrument for the revised Mineral Resources Law and establish a unified governance architecture across the entire mineral value chain — exploration, production, processing, stockpiling, and emergency supply mobilisation — with inter-agency coordination spanning MNR, NDRC, MIIT, the State Grain and Material Reserves Administration, NEA, and the State Administration of Mine Safety. The Regulations introduce a three-layer strategic reserve system (physical stockpiles, production-capacity reserves, and in-ground strategic areas), grant the state authority to directly organise mining and distribution during supply emergencies (Article 59), and explicitly authorise countermeasures against nations that restrict China's access to mineral supply chains (Article 76).

The Cyberspace Administration of China (CAC) issued the Provisions on Promoting and Regulating Cross-Border Data Flows (《促进和规范数据跨境流动规定》) on 22 March 2024, effective immediately. The rules substantially raise the thresholds at which CAC security assessment, Standard Contractual Clauses (SCC), or Personal Information Protection Certification are required for outbound data transfers, and create categorical exemptions for contract performance, HR management, intra-group transfers below a volume threshold, and transit data processed in China with no domestic personal information introduced. A Free Trade Zone pilot mechanism allows designated FTZs (Shanghai Lingang, Tianjin, Beijing) to publish their own negative lists defining which data categories still require prior approval, easing conditions for multinationals with operations in those zones.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

The Cybersecurity Law of the People's Republic of China (中华人民共和国网络安全法) was adopted at the 24th meeting of the 12th NPC Standing Committee on 7 November 2016 and entered into force on 1 June 2017, establishing the foundational legal framework for network security governance across all sectors. The law creates the Critical Information Infrastructure Operator (CIIO) designation and protection regime administered by the Cyberspace Administration of China (CAC), mandates data localisation for personal information and important data collected or generated by CIIOs in China, and establishes cross-border data-transfer security assessment requirements under Article 37 — the provision later operationalised by DSL 2021, PIPL 2021, and the 2024 CAC Cross-Border Data Flow Provisions. The CSL introduced multi-level protection scheme (等级保护制度 / MLPS) obligations for all network operators and network-product/service security-review procedures, under which CAC triggered the cybersecurity review of Didi Global in 2021 and the exclusion of Micron's products from Chinese critical-infrastructure projects in 2023.