CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
Expected Future Developments in 2026 In 2026, the CBDT Certification mechanism will likely become another compliance route for companies. Companies need to prepare for this shift by ensuring their data protection practices align with the certifica - tion criteria. It is anticipated that the formulation and implementa - tion of the Negative List within FTZs will be significant - ly accelerated in 2026. Practical enforcement at the local level is already underway, with numerous FTZs having released Negative Lists in 2024 and 2025. Driv - en by central policy guidance and solidified through successful local pilots, 2026 is expected to be a piv - otal year during which more FTZs will advance the development and implementation of their respective Negative Lists.
organisations may not provide any foreign judicial or law enforcement body with any data stored within China without the approval of the competent authority.
5.5 Recent Developments Key Recent Developments
Measures for the Certification of Cross-Border Provi - sion of Personal Information, which came into force on 1 January 2026, signify the comprehensive implemen - tation of China’s CBDT compliance framework. Serv - ing as the final and integral component of the CBDT mechanisms, these Measures provide companies with a clear and stable compliance pathway through a mar - ket-based certification mechanism, thereby refining the overarching CBDT regulatory framework. In September 2025, the National Cybersecurity Notifi - cation Center publicly disclosed an enforcement case in which a multinational enterprise was penalised for illegal CBDT activities. The identified violations includ - ed failure to do the following: • complete the requisite security assessment for the CBDT; • provide adequate notification to its users regarding the transfer; • obtain separate consent from users; and • implement necessary security technical measures.
62 CHAMBERS.COM
Powered by FlippingBook