On 12 February 2025, the Cyberspace Administration of China (CAC) issued the Measures for the Administration of Personal Information Compliance Audit (“Audit Measures”), which will take effect from 1 May 2025. The draft of the Audit Measures was first released for solicitation of public comments on 3 August 2023, and it took a year and a half for CAC to finalize the Audit Measures. In the final version of the Audit Measures, there are a few notable changes compared with the draft version, which reflect the evolving and more relaxed data protection regulatory stance of the CAC.

On March 22, 2024, the Cyberspace Administration of China issued the long-awaited Provisions on Facilitating and Standardizing Cross-Border Data Flow (the “New CBDT Rules”), which took effect from the same date. With the New CBDT Rules being promulgated, the Chinese government finally released positive signals with moderate relaxation of its stringent control over CBDT activities since the promulgation of the Personal Information Protection Law of the PRC in 2021, and the implementation of CBDT security assessment and China Standard Contract for Cross-Border Transfer of Personal Information starting from late 2022.

On 25 January 2024, the State Council of the People’s Republic of China promulgated the Interim Regulations on Administration of Carbon Emissions Trading (“Regulations”), which will come into force on 1 May 2024.
The Regulations set out the regulatory regime over carbon emission allowance (CEA) in the mandatory carbon market, while the Administrative Measures for Voluntary Trading of Greenhouse Gas Emission Reduction (Trial), effective from 19 October 2023, regulate the China Certified Emission Reduction (CCER) in the voluntary carbon market.

On 29 December 2023, the Standing Committee of the National People’s Congress of the People’s Republic of China promulgated the amended Company Law of the People’s Republic of China (“2023 Company Law”), after its deliberation of four versions of draft amendments in the past three years. The 2023 Company Law will come into force on 1 July 2024.
The amendments cover a wide range of topics, including capital contribution and reduction, equity/share transfer and repurchase, corporate governance matters (such as organizational structure and responsibilities and duties of controlling shareholders, actual controllers, directors, supervisors and senior management, etc.), shareholder rights protection, company establishment and dissolution/liquidation, etc.

Just one week following the release of the draft Rules concerning the Standard Contract for Cross-Border Transfers of Personal Information, the Cyberspace Administration of China finalized and issued the long-awaited Measures for the Security Assessment of Transfers of Data Abroad on 7 July 2022. The Measures provide the implementation rules and guidelines concerning the security assessment mechanism for cross-border data transfers outside of China, as established in China’s three overarching data protection laws, the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law. The Measures will take effect and will be implemented from 1 September 2022. Companies will have a grace period of six months to comply with the Measures.

On 30 June 2022, the Cyberspace Administration of China released the draft Rules concerning the Standard Contract for Cross-Border Transfer of Personal Information together with the draft Standard Contractual Clauses (China SCCs) for public consultation. The China SCCs for cross-border transfer of personal information are one of the three mechanisms for transferring personal information outside of China as stipulated in the Personal Information Protection Law of China.

5G is helping to drive important business opportunities with its high-speed connections, ultra-low latency, and ability to transmit huge volumes of data and enable simultaneous connections with multiple devices. As businesses seek to leverage 5G technology, find out sazwwhat blind spots exist and how connected solutions can help.

On 20 August 2021, the Standing Committee of the National People’s Congress passed the Personal Information Protection Law of the PRC (PIPL), after deliberating two draft versions and seeking public comment in a ten-month span. The passage of the PIPL signifies that China is stepping into a more robust and comprehensive personal information protection regime by establishing a unified, cross-sector legislation, as the EU does with the aid of the General Data Protection Regulation.