Since 2021, China’s new laws on security, data, and trade have reshaped the compliance environment for any foreign company, executive, or platform operating in or with the country. The National People’s Congress and its Standing Committee have enacted 36 new laws in that period, alongside 63 revisions and 35 formal decisions on legal matters.1Ministry of Justice of the People’s Republic of China. China Formulates 36 New Laws Since 2021 The changes cover espionage, cybersecurity, personal data, export controls, sanctions countermeasures, bribery, corporate governance, generative AI, and cultural policy. Many carry penalties severe enough to close a business or send an individual to prison.
Counter-Espionage Law and What Now Counts as Spying
The 2023 revision to the Counter-Espionage Law expanded the definition of espionage well beyond the theft of classified military or state secrets. Espionage now covers obtaining or providing any documents, data, or materials related to “national security and interests,” a phrase far broader than “state secrets” in the previous version.2China Law Translate. Counter-Espionage Law of the People’s Republic of China That gives authorities wide discretion to treat commercial due diligence or academic research as sensitive if they decide it touches national interests.
The revised law also brings cyberattacks into the espionage framework. Hacking, network intrusions, and digital interference targeting government bodies or critical information systems now qualify as espionage activities.3JURIST. China Lawmakers Broaden Scope of Anti-Espionage Laws Digital intelligence gathering carries the same legal weight as in-person spying.
Investigative powers grew as well. State security officials can inspect smartphones, laptops, and storage devices belonging to anyone suspected of threatening national security. Refusing to cooperate can result in administrative detention or fines. The law authorizes exit bans, preventing individuals under investigation from leaving the country. These measures apply equally to Chinese citizens and foreign nationals, and they can be imposed without advance notice.
Exit Bans in Civil and Commercial Disputes
Exit bans are not limited to espionage or criminal investigations. Chinese courts can order travel restrictions during ordinary civil lawsuits and judgment-enforcement proceedings. If a court believes a key individual might leave the country and avoid paying a judgment, it can block that person from departing. The person typically cannot leave until the underlying debt or legal obligation is resolved or adequately guaranteed.
The individuals most exposed are a company’s registered legal representative and senior managers listed in government filings. Courts and border authorities work from official registration records, not internal corporate documents. Resigning from a role or passing a board resolution does not remove the risk if government records still show you in the position. Foreign executives and Chinese nationals face the same exposure, and most people learn of the restriction only when stopped at the border or during visa processing.
Data Security, Personal Information, and Cross-Border Transfers
Three overlapping statutes govern data in China: the Data Security Law (DSL), the Personal Information Protection Law (PIPL), and the Cybersecurity Law. The State Council supplemented these in January 2025 with the Regulations on Network Data Security Management.
Data Security Law
The DSL sorts data into tiers based on its significance to national security and the economy. “Core state data” sits at the top and faces the tightest controls. Mishandling or illegally exporting core state data can result in fines of 2 million to 10 million yuan, suspension of operations, or revocation of the business license. A separate tier of “important data” carries its own restrictions: providing important data abroad without authorization can lead to fines up to 1 million yuan in ordinary cases and up to 10 million yuan in serious cases, along with potential license revocation.4Supreme People’s Procuratorate of the People’s Republic of China. Data Security Law of the People’s Republic of China
Important data collected inside China generally must be stored domestically. Any outbound transfer must first pass a security assessment conducted by state authorities.4Supreme People’s Procuratorate of the People’s Republic of China. Data Security Law of the People’s Republic of China Multinationals operating in China need local data infrastructure and a compliance workflow for every cross-border data flow.
Personal Information Protection Law
The PIPL requires specific, informed consent before collecting personal information. Cross-border transfers of personal data require separate explicit consent, and organizations handling data on more than one million individuals must pass a government security review before sending personal information out of the country.5National People’s Congress of the People’s Republic of China. Personal Information Protection Law of the People’s Republic of China Smaller-scale transfers can move through standard contracts filed with regulators or through privacy-protection certification, each with its own compliance burden.
Penalties are steep. Fines can reach 50 million yuan or 5 percent of the organization’s prior-year revenue. Individual executives found directly responsible face personal fines up to 1 million yuan and potential bans from serving as directors or senior managers. The law also grants individuals the right to access and copy the personal information a company holds on them, request corrections, and demand deletion when the original purpose no longer applies or when consent is withdrawn.6Office of the Privacy Commissioner for Personal Data, Hong Kong. Mainland’s Personal Information Protection Law
Organizations that process personal information above thresholds set by the Cyberspace Administration of China must appoint a dedicated personal information protection officer.6Office of the Privacy Commissioner for Personal Data, Hong Kong. Mainland’s Personal Information Protection Law That role coexists with the broader authority of state agencies to access data for public security or criminal investigations.
Export Controls on Rare Earths and Dual-Use Goods
China’s Export Control Law, in effect since December 2020, regulates the export of dual-use goods, military products, nuclear materials, and related technologies and data. Exporters must obtain licenses before shipping controlled items. A catch-all provision requires license applications even for unlisted items when the exporter knows or should know the goods could be used in weapons programs or could threaten national security. Penalties range from fines up to 5 million yuan to revocation of export privileges, and individuals convicted of criminal offenses can face lifetime bans from export activities.
The government has used the framework aggressively. In April 2025, the Ministry of Commerce and General Administration of Customs imposed export controls on medium and heavy rare earth elements, including samarium, gadolinium, terbium, dysprosium, lutetium, scandium, and yttrium, along with their alloys, oxides, and compounds.7Ministry of Commerce, People’s Republic of China. Announcement No.18 of 2025 – Export Control on Medium and Heavy Rare Earth Related Items These materials are used in permanent magnets, defense systems, and advanced electronics. Exporters must apply for a license and declare at customs whether the goods are controlled items. Shipments are not released during any questioning period. Earlier rounds targeted gallium, germanium, and antimony.
Anti-Foreign Sanctions and Blocking Rules
The Anti-Foreign Sanctions Law, adopted in 2021, gives the Chinese government tools to retaliate against foreign governments and entities that impose sanctions on Chinese individuals or organizations. Countermeasures include visa denials, entry bans, deportation, asset freezes, property seizures, investment prohibitions, export bans, and restrictions on cooperation in education, technology, healthcare, and legal services.
In April 2026, the State Council issued implementation rules that formalized a “malicious entity list” targeting foreign organizations and individuals that promote or carry out what China considers unlawful extraterritorial jurisdiction measures by foreign governments.8State Council of the People’s Republic of China. China Issues Rules on Countermeasures Against Foreign States’ Unlawful Extraterritorial Jurisdiction The rules prohibit any organization or individual from enforcing or assisting in the enforcement of foreign sanctions China deems unlawful. Chinese citizens and organizations affected by such sanctions can file lawsuits in Chinese courts against the parties enforcing them.
A separate mechanism, the Unreliable Entity List administered by the Ministry of Commerce, targets foreign companies whose actions are deemed to harm Chinese enterprises or threaten national security. Entities placed on the list can be banned from importing, exporting, or investing in China, and their personnel can lose work permits and residence qualifications. Multinationals caught between Chinese and Western sanctions regimes face a direct compliance conflict: complying with one country’s sanctions risks triggering penalties from the other.
Tougher Bribery Penalties Under Criminal Law Amendment XII
The 12th Amendment to the Criminal Law took effect on March 1, 2024, and toughened penalties for both giving and receiving bribes.9National People’s Congress of the People’s Republic of China. China Amends Criminal Law to Toughen Punishment for Bribery Earlier enforcement focused heavily on bribe recipients. The amendment rebalances the approach by increasing maximum prison terms for people who offer bribes, particularly in industries the government considers high-risk for corruption, including pharmaceuticals, finance, infrastructure, energy, and state-owned enterprises.
Seven aggravating circumstances now trigger heavier bribery sentences:
- Offering bribes multiple times or to more than one official
- State employees who bribe other officials
- Bribery connected to key national infrastructure or programs
- Bribes paid to secure job placements, promotions, or transfers
- Bribery directed at supervisory, law enforcement, or judicial officers
- Bribery in sectors including environmental protection, financial regulation, workplace safety, food and drug safety, disaster relief, social security, education, and healthcare
- Using illegally obtained money to pay bribes
For entities that accept bribes, the amendment distinguishes between “serious” and “especially serious” circumstances. The person directly in charge of a bribe-taking organization faces up to three years in prison under the serious tier and three to ten years under the especially serious tier.9National People’s Congress of the People’s Republic of China. China Amends Criminal Law to Toughen Punishment for Bribery
Foreign Investment Access and the Revised Company Law
Foreign Investment Law and the Negative List
The Foreign Investment Law uses a Negative List to identify sectors where foreign participation is restricted or banned. The 2024 edition prohibits foreign investment in areas including rare earth mining, tobacco sales, domestic mail delivery, and certain genetic research. In telecommunications, foreign investors cannot hold more than 50 percent of most value-added telecom services and are excluded from basic telecommunications operations unless a Chinese investor holds the controlling stake.10Beijing Investment Promotion Service Center. Special Administrative Measures (Negative List) for Foreign Investment Access (2024 Edition) Media and news information services face similar restrictions or outright prohibitions.
Outside the Negative List, foreign-invested enterprises are entitled to the same legal treatment as domestic companies. Article 22 of the Foreign Investment Law prohibits government agencies from forcing technology transfers through administrative pressure, stating that technology cooperation must be voluntary and governed by commercial terms negotiated between the parties.11National Development and Reform Commission. Foreign Investment Law of the People’s Republic of China
Revised Company Law
The amended Company Law took effect on July 1, 2024, and applies to every company registered in China, including foreign-invested subsidiaries. One of the most consequential changes is a five-year maximum deadline for shareholders to complete their registered capital contributions. Companies that existed before the law took effect have a transition period running until June 30, 2027, to align their capital contribution timelines.
The law also restructured board requirements. Companies with 300 or more employees must include at least one employee representative on the board of directors, unless the company already has employee representatives on a separate board of supervisors. Companies can establish an audit committee under the board of directors to replace the traditional board of supervisors entirely. Smaller companies with few shareholders can opt for a single supervisor or, with unanimous shareholder consent, no supervisor at all. Failure to align governance with the new requirements within the transition period can result in administrative penalties or loss of the business license.
Generative AI Rules
China became one of the first countries to impose binding rules on generative AI. The Interim Measures for the Management of Generative Artificial Intelligence Services took effect on August 15, 2023.12China Law Translate. Interim Measures for the Management of Generative Artificial Intelligence Services The rules cover any company using generative AI technology to offer text, image, audio, or video generation services to the public inside mainland China. Internal research and development that does not produce a public-facing service falls outside the scope.
Content restrictions are explicit. Generated output must uphold “Core Socialist Values,” and providers must take measures during algorithm design, training data selection, and model optimization to prevent output that could incite separatism, promote terrorism or extremism, or contain discrimination based on ethnicity, religion, gender, or age.12China Law Translate. Interim Measures for the Management of Generative Artificial Intelligence Services Providers whose services have “public opinion properties or the capacity for social mobilization” must complete security assessments and file their algorithms with regulators.
Patriotic Education Duties on Online Platforms
The Patriotic Education Law took effect on January 1, 2024.13Ministry of Justice of the People’s Republic of China. China Adopts Patriotic Education Law The law reaches schools, families, and religious institutions, and it also imposes direct obligations on online platforms. Article 32 requires internet information service providers to strengthen the creation of patriotic education content and to produce and spread information that embodies “the spirit of patriotism.”14National People’s Congress of the People’s Republic of China. Patriotic Education Law of the People’s Republic of China Combined with content-moderation obligations under the Cybersecurity Law and the generative AI rules, tech companies must actively curate their platforms in favor of nationalistic messaging or face regulatory consequences.
Who Enforces These Laws
Enforcement is split across several agencies. The Cyberspace Administration of China coordinates oversight of cybersecurity, data security, and personal information protection. The Ministry of Public Security handles criminal enforcement and operates the multi-level cybersecurity protection scheme. The Ministry of State Security leads on espionage and counter-intelligence matters. When any of these agencies initiates a data security audit, the targeted entity must provide access to servers, logs, and internal protocols. On-site inspections verify compliance with data localization, security standards, and content filtering.
Mandatory incident reporting runs across the data and cybersecurity laws. Organizations that discover security breaches or threats must report them to the relevant authorities, with the chain of command running from local offices up to national bureaus, which make final decisions on penalties or corrective measures. Entities can challenge findings through administrative review. For multinationals, the overlapping jurisdiction of these agencies means a single compliance failure can trigger investigations from multiple directions at once.