Industrial Policy & Trade Monitor· 2665 actions· ✨ 90 recent

Arrêté ministériel n° 00964/CAB.MIN/MINES/01/2025, signed 19 December 2025 by DRC Mines Minister Louis Watum Kabamba, suspends with immediate effect all activities of entities (notably comptoirs d'achat / buying counters, treatment units and similar structures) involved in the purchase, processing, transformation and commercialisation of copper and cobalt minerals sourced from artisanal exploitation across the country. Industrial, legally established mining operators are excluded. The order requires affected entities to submit compliance documentation within ten days, establishes an ad hoc commission to verify administrative, legal, technical and traceability conformity (15-day review window), and obliges operators to demonstrate the lawful origin of their supplies in line with OECD due-diligence guidance. Framed as a "conservatory" measure to restore order in the cupro-cobaltifère value chain and curb illicit exports.

Czech Republic's first standalone federal statute on the resilience of critical-infrastructure entities — Act No. 266/2025 Sb., "Zákon o odolnosti subjektů kritické infrastruktury a o změně souvisejících zákonů" (Critical Infrastructure Act). Transposes EU Directive 2022/2557 (CER Directive on the resilience of critical entities) into Czech law and removes critical-infrastructure regulation from the earlier crisis-management law (Zákon č. 240/2000 Sb.) into a dedicated statute. Covers the 11 CER-Directive sectors (energy, transport, banking, financial-market infrastructure, health, drinking water, wastewater, digital infrastructure, public administration, space, food production-processing-distribution) and obligates designated operators of essential services to conduct risk analyses, implement technical/organisational resilience measures, report incidents to sector-competent authorities, and submit to inspection. Published in the Sbírka zákonů on 4 August 2025; in force 19 August 2025; operator information-obligation deadline 1 March 2026.

Vietnam's Government adopted Decree 193/2025/ND-CP on 2 July 2025 (effective retroactively from 1 July 2025) as the primary operational statute elaborating the Law on Geology and Minerals No. 54/2024/QH15. The decree decentralises licensing for most mineral categories to provincial People's Committees while preserving central Ministry of Agriculture and Environment (MAE) authority over strategic and critical minerals, including rare earths, gold, uranium, and thorium. It codifies a three-tier Group I/II/III mineral classification, imposes a 100% financial-capacity bond requirement for exploration licences, sets a 40-working-day processing deadline, and defines the closed-enterprise framework that makes Vietnam's 1 January 2026 raw rare-earth export ban operationally enforceable through a Prime-Minister-designated list of licensed enterprises.

The National Assembly of Vietnam passed the Personal Data Protection Law (Luật Bảo vệ dữ liệu cá nhân), Law No. 91/2025/QH15, on 26 June 2025; it enters into force on 1 January 2026. The PDPL is Vietnam's first statutory (rather than decree-level) personal-data-protection framework, elevating the prior Decree 13/2023/ND-CP (PDPD) regime into a 5-chapter, 39-article primary statute and adding revenue-based administrative penalties of up to 5% of prior-year annual revenue for cross-border data-transfer violations and up to 10x illegal gains for unlawful data trading. The law is implemented by Decree 356/2025/ND-CP (issued 31 December 2025, effective 1 January 2026) and applies extraterritorially to foreign organisations offering services to or processing the personal data of Vietnam residents.

Peraturan Menteri Energi dan Sumber Daya Mineral (Permen ESDM) No. 6 of 2024, signed by Minister Arifin Tasrif on 30 May 2024 and published in the Berita Negara Republik Indonesia, establishes the procedural framework governing how holders of Mining Business Licences (IUP) and Special Mining Business Licences (IUPK) for copper, iron, lead, and zinc production may continue to sell processed mineral products abroad during the final phase of domestic smelter construction. Licence holders that previously obtained MEMR export recommendations and whose refining facilities have reached commissioning stage but are not yet at full operational capacity may apply for time-bound extensions to sell concentrate and semi-processed ore offshore through 31 December 2024, subject to quarterly physical inspections by the Director General of Minerals and Coal. The regulation is the MEMR-side companion instrument to the same-day Permendag 10/2024 (Ministry of Trade copper-concentrate and anode-sludge export prohibition), together constituting the complete legal architecture of Indonesia's copper hilirisasi (downstream- processing) mandate. Its scope is broader than the Trade Ministry rule: it covers copper, iron, lead, and zinc whereas Permendag 10/2024 targets copper and anode-sludge only, and it operates as the conditional derogation mechanism (MEMR) to Permendag 10/2024's absolute prohibition regime (Trade Ministry).

Regulation (EU) 2023/1115, adopted 31 May 2023 and in force 29 June 2023, requires all EU operators and traders placing seven in-scope commodities and their derived products on the EU market — or exporting them from the EU — to file due-diligence statements certifying that goods are deforestation-free (no land cleared after 31 December 2020) and produced in compliance with the relevant legislation of the country of origin. A Commission-administered risk-classification system assigns producer countries to low, standard, or high-risk tiers with differentiated due-diligence burdens. Application was subsequently postponed twice: to 30 December 2026 for large operators (Reg (EU) 2024/3234 and Reg (EU) 2025/2650).

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

On 27 January 2018 the DRC National Assembly adopted Loi n° 18/001, comprehensively amending the foundational 2002 Mining Code (Loi n° 007/2002); President Joseph Kabila promulgated the law on 9 March 2018, published in the Journal Officiel special issue of 28 March 2018, with implementing Décret n° 18/024 (Règlement Minier) following on 8 June 2018. The Code introduces a 10% royalty on minerals designated "strategic" by the Council of Ministers — cobalt, coltan, lithium, and germanium confirmed — up from the 2% standard non-ferrous rate, and raises all standard mining royalties (non-ferrous 2→3.5%, precious metals 2.5→3.5%, precious stones 4→6%). The state's mandatory free-carry interest in new mining projects is doubled from 5% to 10% (Article 71), with a further 10% paid-carry option creating an effective 20% state-participation floor; contract-stability guarantees are simultaneously curtailed from 10 to 5 years (Article 276), explicitly invalidating pre-existing stabilisation clauses. As the foundational statute governing every DRC mining-rights grant, royalty-rate setting, and export-control delegation, the 2018 Code is the parent authority for ARECOMS (established 2019 under its strategic-minerals framework) and the legal basis for both the 2025 cobalt export-ban/quota regime and the 2025 artisanal-processing suspension — making it the mandatory upstream context for the entire filed DRC action cluster.

On 27 December 2017 President Nursultan Nazarbayev signed Code No. 125-VI ZRK "On Subsoil and Subsoil Use," a wholesale recodification replacing the 2010 Subsoil Use Law that entered into force on 29 June 2018 (with certain provisions deferred to 1 January 2019). The Code establishes the licensing architecture for all mineral extraction in Kazakhstan — the world's leading uranium producer (~40% of global U₃O₈ output, ~22,000 tU/yr) and a top-11 oil exporter (~1.8 mbpd) — covering solid minerals, hydrocarbons, and uranium under a single codified framework. For solid minerals the Code introduces a liberalised "first-come first-served" auction-free licence model for non-strategic deposits and a state-tender model for strategic deposits, alongside subsoil-use rights transfer and pledge provisions governing all M&A in the sector. For uranium the Code codifies the National Atomic Company Kazatomprom's statutory role as state operator over all uranium blocks, with government priority pre-emption rights and mandatory Kazatomprom participation in all production licences. For hydrocarbons the Code establishes the concession and production-sharing framework governing the pre-salt Caspian mega-projects (Tengiz, Karachaganak, Kashagan) and the model contract architecture for petroleum products. Horizontal obligations — local Kazakh-content procurement floors, social-package requirements, and environmental-restoration mine-closure security — apply across all subsoil-use categories. Structurally this Code is the parent statute for every subsequently filed KZ action: the 2023-12-28 REE Comprehensive Plan and the 2025-12-26 Kazatomprom uranium-priority amendments both operate under delegated authority created by this Code.

The Cybersecurity Law of the People's Republic of China (中华人民共和国网络安全法) was adopted at the 24th meeting of the 12th NPC Standing Committee on 7 November 2016 and entered into force on 1 June 2017, establishing the foundational legal framework for network security governance across all sectors. The law creates the Critical Information Infrastructure Operator (CIIO) designation and protection regime administered by the Cyberspace Administration of China (CAC), mandates data localisation for personal information and important data collected or generated by CIIOs in China, and establishes cross-border data-transfer security assessment requirements under Article 37 — the provision later operationalised by DSL 2021, PIPL 2021, and the 2024 CAC Cross-Border Data Flow Provisions. The CSL introduced multi-level protection scheme (等级保护制度 / MLPS) obligations for all network operators and network-product/service security-review procedures, under which CAC triggered the cybersecurity review of Didi Global in 2021 and the exclusion of Micron's products from Chinese critical-infrastructure projects in 2023.