2026-08-28
China's third data-export route opened on 1 January 2026 under CAC and SAMR Order No. 20. 第20号令使个人信息保护认证成为可用通道，2026年1月1日起施行。Eligibility is narrow: non-CIIO handlers, 100,000 to under 1m individuals' non-sensitive data...
2026-08-28
China has removed foreign-equity caps on internet data centre (IDC) and other value-added telecom services in Beijing, Shanghai, Hainan and Shenzhen.中国已在北京、上海、海南、深圳取消互联网数据中心（IDC）等增值电信业务的外资股比限制。As of June 2026, 166 foreign-invested enterprises had received...
2026-08-28
China's telecom value-added services (VAS) liberalization has reached 166 foreign-funded pilot approvals as of the first half of 2026. 截至 2026 年上半年，增值电信业务扩大开放试点已向 166 家外资企业发放批复。The Ministry of Industry and Information...
2026-08-28
PIPL took effect on 1 November 2021 and has extraterritorial reach, binding overseas processors that handle personal information of individuals in China. 《个人信息保护法》于2021年11月1日施行，并具有域外效力（第三条），约束处理中国境内自然人个人信息的境外处理者。Processing requires a documented lawful basis...
Cybersecurity / 网络安全, PIPL Compliance / 个保法合规
2026-08-28
The Measures for Network Data Security Risk Assessment, jointly issued by the CAC, MIIT and MPS, took effect on 20 August 2026. 由国家网信办、工业和信息化部、公安部联合制定的《网络数据安全风险评估办法》于 2026 年 8 月 20...
2026-08-28
The Personal Information Protection Law gives three cross-border paths — security assessment, standard contract, and certification — all now operable after the 2026 Certification Measures took effect on 1...
2026-08-28
Cross-border transfers of employee personal information are exempt from the security-assessment, standard-contract and certification routes where they implement cross-border HR management under a duly adopted labour rule or collective...
2026-08-28
PIPL creates two distinct governance roles: a personal information protection officer (PIPO) under Article 52, and a domestic dedicated institution or designated representative for overseas processors under Article 53....
2026-08-28
The CAC's January 2026 draft "Rules on Personal Information Collection and Use by Internet Applications" codifies consent, separate consent for sensitive data, and minimal collection for apps, SDKs, distribution...
2026-08-28
CAC Order No. 18, the Measures for the Administration of Personal Information Protection Compliance Audits, was published on 14 February 2025 and took effect on 1 May 2025. ...