The regulatory landscape in China around data protection and
flows continues to develop. Since the 2017 Cybersecurity Law, China
has been refining the legal and regulatory framework for data
protection—it has implemented new laws and regulations that
set comprehensive rules for data processing activities across all
industries in China and cover the rules regarding cross-border data
transfers and data localization, which are essential for critical
information infrastructure operators1 and other data
processors.
Multinationals are expected to deal with more stringent data
regulation requirements and procedures in M&A
transactions where cross-border corporate structures or
cross-border data transfers are involved. In particular, these
types of transaction parties, including but not limited to sellers,
buyers, and their advisors, should closely review and understand
the relevant data protection requirements, and conduct the
necessary risk assessments as part of
