On July 31, 2026, China's State Council released new Regulations on the Administration of Entry and Exit that will standardize and enhance China’s oversight of entry and exit across multiple areas of regulatory concern. U.S. institutions should act now to identify all relevant travel to and from China by institutional stakeholders, evaluate any associated risks, and take steps to mitigate risks. On July 31, 2026, China's State Council released new Regulations on the Admini

On July 24, 2026, the CAC released a Q&A on Cross-Border Data Transfer Security Management that clarifies key compliance expectations. Of particular note, the CAC Q&A emphasizes the need for data minimization in cross- border transfers of job applicant resumes to overseas headquarters or affiliates. On July 24, 2026, the Cyberspace Administration of China (CAC) released guidance clarifying and heightening its compliance expectations in certain cross-border data transfer si

The Shanghai municipal branch of the Cyberspace Administration of China (“CAC”) has fined the online travel agency Ctrip RMB 10 million, citing failure to fulfill cross-border data security assessment obligations and illegal outbound transfer of personal information. This action marks a new escalation in China's enforcement of its data protection laws, including one of the most substantial fines imposed under the PIPL to date. On June 13, 2026, the Shanghai municipal branc

A new NPRM from the Office of Management and Budget (OMB) would significantly reshape federal discretionary grantmaking and allow expanded discretion for the administration to affect its priorities throughout the grantmaking lifecycle. Institutions with programs or collaborations involving China or other countries of concern should assess the potential impact of the proposed regulations now. On May 29, 2026, the Office of Management and Budget (OMB) published a notice of

On April 13, 2026, the State Council of the PRC published new Regulations to counter foreign sanctions measures it deems to be improper assertions of extraterritorial jurisdiction. The new Regulations could target organizations and individuals who, by virtue of their compliance with foreign sanctions measures, particularly measures that scrutinize the control of Chinese entities, may be accused of implementing such measures. IHEs with research collaborations or academic pro

On August 1, 2025, the PRC Supreme People’s Court issued the Interpretation II on Issues Concerning the Application of Law in the Trial of Labor Dispute Cases, which establishes uniform legal standards in several employment situations that have raised questions in recent years, including the employment relationship in affiliation arrangements, foreign employees, double wages, and two consecutive fixed-term contracts. U.S. institutions with an RO or WFOE in the PRC should revi

On September 11, 2025, the Cyberspace Administration of China released the Measures for Cybersecurity Incident Reporting, which clarify the specific requirements for network operators regarding cybersecurity incident reporting. The Measures require network operators to report certain incidents within one to four hours, depending on the type of entity involved. On September 11, 2025, the Cyberspace Administration of China (“ CAC ”) released the Measures for Cybersecurity Inc

Following a December 29, 2025 notice published by the Cyberspace Administration of China, institutions that handle personal information of children in China must report on their handling activities by January 31 each year (starting January 31, 2026); Several recently effective U.S. state comprehensive data privacy laws impact whether/how institutions may engage in targeted advertising to minors; The same U.S. state laws also impact whether/how institutions may “sell” minors’

China’s Ministry of Public Security (“MPS”) penalized Dior Shanghai for breaching personal information protection obligations, following an investigation into a data breach incident. MPS identified the following violations during the investigation: failure to implement a cross-border transfer mechanism; failure to fully inform data subjects about how their personal information would be handled by an overseas recipient; failure to obtain separate consent for cross-border trans

On October 6, 2025, the final provisions of the DOJ Sensitive Data Rule took effect, completing the framework for the DOJ’s Data Security Program. Institutions engaging in relevant data-sharing activities should move quickly to ensure compliance. On October 6, 2025, the last provisions of 28 C.F.R. Part 202, “ Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons ” (“DOJ Rule”) took effect, completing the regulatory

On April 25, 2025, TC260 issued the recommended standard Data Security Technology – Security Requirements for Handling of Sensitive...

On July 18, 2025, the CAC issued guidance on reporting the appointment of personal information protection officers. Handlers that reached...

On March 28, 2025, the Cyberspace Administration of China released a draft amendment to the Cybersecurity Law(“Draft Amendment”) for...

The 2025 Government Work Report emphasizes integration of vocational education and general (i.e., non-vocational) education, further...

The CAC and three additional departments jointly announced plans to strengthen PIPL enforcement in 2025 by applying special measures to...

On April 23, 2025, President Trump issued an Executive Order directing the Secretary of Education to step up enforcement of Section 117...

On April 11, 2025, the DOJ National Security Division published new guidance regarding the U.S. Sensitive Personal Data and...

Recently, the CAC released the final Measures for the Administration of Compliance Audits on Personal Information Protection...

On February 19, 2025, China issued the 2025 Action Plan for Stabilizing Foreign Investment, outlining key measures to attract and retain...

On January 8, 2025, the DOJ issued a new final rule to prohibit or restrict transfers of bulk sensitive personal data and certain U.S....