China has taken a series of actions recently in an effort to tighten scrutiny of the data security practices of domestic technology companies. Most prominently, the Cybersecurity Review Office (CRO) and Cyberspace Administration of China (CAC) initiated multiple cybersecurity reviews, including one on Chinese ride-hailing company Didi. These investigations all

On August 31, the National Information Security Standardization Technical Committee issued the Draft of Information Security Technology-Security Specification for Network Data Processing (《信息安全技术 网络数据处理安全规范》 [https://www.tc260.org.cn/front/postDetail.html?id=20200830094619]) for public comments. Comments are due by October 27, 2020. The Draft applies to network operators’

The 20th session of the Standing Committee of the 13th National People’s Congress released the full texts of the Law of the People’s Republic of China on Data Security 数据安全法（草案）》 [https://finance.ifeng.com/c/7xmRiIEOTk8] for public comments on July 3. Comments are due by August

On April 27, 2020, the Cyberspace Administration of China (“CAC”) and eleven other government agencies jointly released the Measures on Cybersecurity Review [http://www.cac.gov.cn/2020-04/27/c_1589535450769077.htm] (Measures) (网络安全审查办法). The Measures take effect on June 1, 2020 The Measures covers facilities that handle large amounts

On June 13, the CAC issued the Personal Information Cross-Border Security Review Measures (Draft) (个人信息出境安全评估办法（征求意见稿) [http://www.cac.gov.cn/2019-06/13/c_1124613618.htm]). The Draft has 22 provisions, covering the security review criteria for cross-border transfer of personal information, contracts related to personal information cross-border transfer, legal