Industrial Policy & Trade Monitor· 2667 actions· ✨ 89 recent

At the APEC Busan summit on 30 October 2025, Presidents Trump and Xi reached the "Economic and Trade Arrangement Between the United States and the People's Republic of China," subsequently implemented on the US side by the executive order "Modifying Reciprocal Tariff Rates Consistent with the Economic and Trade Arrangement" (issued 4 November 2025; effective 12:01 am EST on 10 November 2025; published in the Federal Register on 7 November 2025 as 90 FR 50729 / 2025-19826) and on the Chinese side by a series of MOFCOM and State Council Tariff Commission announcements (notably MOFCOM 2025 No. 90 of 8–9 November 2025). The arrangement is structurally parallel to the already-filed US-Japan, US-Korea and US-Taiwan framework deals but uniquely material because it freezes the highest-stakes bilateral tariff and export-control confrontation of the post-2024 reset. Core US commitments: (i) reciprocal-tariff "additional ad valorem rate of duty" on PRC-origin goods reduced from a prior 20% IEEPA-fentanyl + 10% IEEPA-reciprocal stack to a 10% rate (i.e., the prior 24% / 34% scheduled escalation is suspended), extended through 10 November 2026; (ii) US BIS suspends the so-called "affiliates rule" expanding entity-list controls to majority-owned subsidiaries of listed Chinese firms; (iii) USTR pauses Section 301 maritime / shipbuilding / logistics countermeasures against Chinese vessels for one year. Core PRC commitments: (i) MOFCOM suspends for one year (until 10 November 2026) the 9 October 2025 extraterritorial rare-earth export-control package — including controls on REE processing equipment, lithium-battery manufacturing equipment, and superhard materials; (ii) PRC suspends retaliatory tariffs on a broad swath of US agricultural products through 31 December 2026; (iii) commitment to purchase ≥25 million metric tonnes of US soybeans annually in 2026-2028 and to resume sorghum and log imports; (iv) suspension of MOFCOM antitrust and "unreliable-entity" probes against named US semiconductor and chip-equipment companies; (v) cooperation on fentanyl precursor enforcement. The arrangement does not repeal underlying authorities (IEEPA tariffs, MOFCOM export-control list, Entity List) — it is a calibrated mutual freeze with a one-year sunset and quarterly review checkpoints.

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

The Cybersecurity Law of the People's Republic of China (中华人民共和国网络安全法) was adopted at the 24th meeting of the 12th NPC Standing Committee on 7 November 2016 and entered into force on 1 June 2017, establishing the foundational legal framework for network security governance across all sectors. The law creates the Critical Information Infrastructure Operator (CIIO) designation and protection regime administered by the Cyberspace Administration of China (CAC), mandates data localisation for personal information and important data collected or generated by CIIOs in China, and establishes cross-border data-transfer security assessment requirements under Article 37 — the provision later operationalised by DSL 2021, PIPL 2021, and the 2024 CAC Cross-Border Data Flow Provisions. The CSL introduced multi-level protection scheme (等级保护制度 / MLPS) obligations for all network operators and network-product/service security-review procedures, under which CAC triggered the cybersecurity review of Didi Global in 2021 and the exclusion of Micron's products from Chinese critical-infrastructure projects in 2023.