Industrial Policy & Trade Monitor· 2663 actions· ✨ 89 recent

The Personal Information Protection Law of the People's Republic of China (中华人民共和国个人信息保护法 — PIPL) was adopted at the 30th meeting of the 13th NPC Standing Committee on 20 August 2021 and entered into force on 1 November 2021, constituting the third and final pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Data Security Law (2021). The PIPL is China's comprehensive personal-information statute establishing consent-based and necessity-based legal bases for PI processing, a tiered cross-border personal-data transfer regime (CAC security assessment / PI protection certification / Standard Contractual Clauses), extraterritorial application (Art. 3) to non-Chinese controllers offering services to or analysing the behaviour of PRC residents, and a heightened protection regime for sensitive personal information and data of minors under 14. It mandates data-protection impact assessments, personal-information-protection-officer obligations at designated handlers, breach notification, and a full suite of data-subject rights including access, rectification, deletion, portability, objection, and automated- decision-making opt-out. Article 53 requires overseas controllers to establish a domestic representative or designated entity in China, providing a domestic enforcement counterparty.

The Law of the People's Republic of China on Countering Foreign Sanctions was adopted at the 29th meeting of the Standing Committee of the 13th NPC on 10 June 2021 (Presidential Order No. 90, President Xi Jinping) and entered into force on the same day. Comprising 16 articles, it establishes the unified statutory framework for China's countermeasure regime against foreign states or organisations that "violate international law and basic norms of international relations" by imposing discriminatory restrictive measures against Chinese citizens and organisations — the parent authority under which every China countermeasure-list, Unreliable Entity List, blocking-statute, and supply-chain-security instrument in the IPTM register operates. Article 6 enumerates the countermeasure toolbox (visa denial, asset freezes, transaction prohibitions, and "other necessary measures"); Article 12 is the blocking-statute provision that prohibits PRC persons from implementing foreign discriminatory measures — first operationalised in May 2026 against five US-sanctions-compliant refineries.

The Data Security Law of the People's Republic of China (中华人民共和国数据安全法) was adopted at the 29th meeting of the 13th NPC Standing Committee on 10 June 2021 and entered into force on 1 September 2021, constituting the second pillar of China's cybersecurity and data-governance regulatory trinity alongside the Cybersecurity Law (2016) and the Personal Information Protection Law (2021). The DSL establishes a tiered data-classification regime — "important data" and "national core data" — with escalating security obligations including risk assessment, risk monitoring, breach reporting, and classified-protection requirements for data handlers. It introduces a data-export security review for "important data" generated or collected within China, the statutory parent authority operationalised by the 2024 CAC Cross-Border Data Flow Provisions, and enacts a §36 blocking statute prohibiting Chinese organisations and individuals from transferring data stored in China to foreign judicial or law-enforcement authorities without prior PRC government approval.

Sri Lanka's Imports and Exports (Control) Regulations No. 07 of 2021, published as Gazette Extraordinary No. 2226/48 on 6 May 2021, banned the import of mineral and chemical fertilisers and placed agrochemicals (pesticides, herbicides, fungicides, rodenticides and plant-growth regulators) under a Special Import Licence requirement, applying to shipments with bills of lading issued on or after 6 May 2021. The measure operationalised the government's declared policy of converting Sri Lanka to fully organic agriculture. Facing a sharp drop in crop yields and food insecurity, the government repealed the restrictions from 30 November 2021.

The National Security and Investment Act 2021 (c.25), receiving Royal Assent on 29 April 2021 and entering full force on 4 January 2022, created the UK's first standalone investment-screening regime, separating national-security review from the Competition and Markets Authority merger-control process. The Act empowers the Secretary of State to call in any acquisition of "control or influence" over a qualifying entity or asset on national-security grounds, and designates 17 sensitive sectors in which acquisitions crossing 25%/50%/75% share-or-voting-rights thresholds (or material influence) require mandatory pre-completion notification to the Investment Security Unit (Cabinet Office); completion before clearance is void and criminal sanctions of up to 5 years imprisonment apply to non-notifying parties. The Act is the structural peer of US CFIUS/FIRRMA (2018), EU Regulation 2019/452, Germany AWG §§55–62, France Décret 2014-479, Netherlands Wet Vifo, and the broader allied FDI-screening parent-statute lattice, and the enabling statute under which all UK mandatory-notification schedule amendments operate.