Cybersecurity

CSRC permits Chinese companies to list overseas with VIE structure after filing; SEC updates disclosure guidance for China-based companies to highlight VIE risks; and Xinjiang forced labor ban signed into law

Both multinationals and domestic companies have already enacted changes to their internal policies and operations in response to China's new data and personal information processing requirements, from human resources management to customer privacy authorizations

Important auto data requires a security assessment when transferred outside of mainland China

OFAC prohibits U.S. investments in AI company SenseTime, Hong Kong listing postponed; CBIRC to remove foreign ownership cap for insurance asset management firms; MIIT orders removal of 106 apps over data violations

China publishes its GDPR law

The U.S. adds 12 Chinese entities to its export blacklist; Rules regulating listed companies to be consolidated; Didi ordered by regulators to delist from NYSE

Data processors may not take biometric features as the sole method of authenticating individuals' identities

Compliance advice that recognizes business necessities is crucial for effective in-house work

Apps are required to inform users of third party use of their personal information