Safe Harbors Part II - China's Safe Harbor Rules Lower The Barrier For Cross-Border Data Transfer

China's cross-border data transfer regime has moved from paper framework to active enforcement in 2026, with regulators issuing significant fines and new rules for both small and large data processors. The three-pathway framework of CAC security assessment, Standard Contract filing, and personal information protection certification is now fully operational, creating real compliance obligations for any business moving personal data out of China.

对于因开展业务等而需要向中国境外提供个人信息的中国境内企业，《个保法》明确提供了上述三条主要合规路径，即通过安全评估、进行个&#

摘要：数据合规已成为数字经济时代科技企业申请上市的最重要的法律关口之一。本文从2021年度最新（申报）上市案例出发，在梳理、分析相关

为持续加强数据出境安全管理政策宣贯，指导和帮助数据处理者高效合规开展数据出境活动，2025年4月9日，国家互联网信息办公室发布...

得益于药品上市许可持有人制度确立、药品审评审批制度改革、专利链接制度...

2022年，一场震惊全球的数据泄露事件将某知名国际网约车公司推上风口浪尖。黑客通过社交工程手段攻破其第三方供应商员工的VPN权限，进而入侵多个内部系统，导致大量员工和司机的姓名、邮箱、位置信息、账户内容等个人数据遭到外泄。事件发生后，美国联邦贸易委员会（FTC）率先发起调查&#

但同时，鉴于数据资产的特性，比如非排他性、价值的不确定性等，亦会导致数据资产在企业财务报表中体现跟计量存在难度，也会由此而使数据

This comprehensive legal journal explores the evolving landscape of data governance in China's digital economy, examining new regulations for small-scale personal information processors...

2024年9月30日，中国国务院发布了《网络数据安全管理条例》（以下简称"新条例"）， 新条例有效地整合了不同监管维度下对相关...

China's new regulation introduces simplified compliance measures for small-scale personal information processors handling data of fewer than 100,000 individuals.

On 30 September 2026, the SEC proposed rule amendments advancing Chairman Paul S. Atkins’ “responsible retailization” of private markets, expanding retail access to private-market strategies while adding key investor safeguards.

The Federal Trade Commission has issued a proposed enforcement policy statement targeting businesses that use consumer personal data to set individualized prices. While acknowledging it cannot prohibit all personalized pricing, the FTC warns that companies may violate federal law if they fail to clearly disclose their use of personal data in pricing decisions.

Texas Senate Bill 140 (SB 140) took effect 1 September 2025, and applies to conduct occurring on or after that date. The bill amended Section 302 of the Texas Business and Commerce Code to extend registration and disclosure requirements to text messages by expanding the definition of “Telephone solicitation,” which previously applied only to a “telephone call,” to include certain transmissions of text or graphic messages and images. In addition, SB 140 added a definition of “Telephone call” that incorporates the definition found in Section 304, which includes certain text or graphic messages and images, but excludes certain agreed-to transmissions.

The SEC and CFTC have issued coordinated regulatory relief measures that significantly advance crypto-based trading infrastructure in US markets, bypassing Congressional gridlock on the CLARITY Act. These orders establish new frameworks for tokenized securities venues and passive software providers, potentially reshaping how digital assets are traded and accessed in regulated markets.

The European Commission has issued guidelines on transparency obligations under Article 50 of the EU AI Act, clarifying how providers and deployers must inform individuals when they interact with AI systems or are exposed to AI-generated content. These non-binding guidelines address a wide range of AI applications, from chatbots to deepfake technologies, and establish four main transparency scenarios with specific disclosure requirements that businesses must now prepare to implement.

Venezuela's post-Maduro reopening is creating unprecedented opportunities for foreign investors across energy, mining, telecommunications, and infrastructure sectors. With expanding OFAC sanctions relief, landmark legislative reforms, and major US companies nearing multibillion-dollar deals, the country presents investment prospects not seen in a generation—though success requires disciplined navigation of corruption, security, and regulatory risks.

The European Union's new Consumer Rights Directive amendment introduces a mandatory "withdrawal button" for online merchants, fundamentally changing how consumers exercise their 14-day right of withdrawal from distance contracts. This requirement, effective June 19, 2026, applies to any trader—including US-based companies—actively selling to EU consumers, creating new compliance obligations around button placement, design standards, data collection, and confirmation processes. Understanding whic

The EU has introduced its first major amendment to the AI Act through the AI Omnibus regulation, which delays certain compliance deadlines while maintaining others. Organizations must understand which obligations remain on schedule, including transparency requirements and general-purpose AI provisions, and which have been deferred, such as high-risk AI system requirements.

The Council of the European Union adopted a regulation on the reduction of methane emissions in the energy sector (Regulation).

The United States and Saudi Arabia have signed a landmark nuclear cooperation agreement under Section 123 of the Atomic Energy Act, establishing the legal framework for decades of civilian nuclear partnership. This agreement resolves years of debate over nonproliferation conditions and positions US companies to participate in Saudi Arabia's ambitious civil nuclear program. The deal carries significant implications for US engagement in the Middle East, international nuclear commerce, and the global competiti