Art. 13 of the "Interim Measures for Data Security Management of Accounting Firms" mandates that audit working papers produced by accounting firms must be stored within the territory of the People's Republic of China, in accordance with relevant regulations. Encryption devices are required to be installed domestically, managed and maintained by local teams, with encryption keys likewise retained within national borders. Pursuant to Art. 19, any transfer of audit working papers abroad must receive prior approval, and accounting firms are obliged to establish a tiered review mechanism governing such exports, alongside implementing comprehensive responsibilities for data security management and control. In addition, in accordance with Art. 14, accounting firms must establish a data backup system to ensure the continued access, retrieval, and use of relevant audit working papers in the event of disruption or restriction to audit-related application systems due to external technical factors.

Section 9.2.i of the "Amendment to the Information Security Technology – Personal Information Security Specification" provides that where personal biometric information must not be shared or transferred unless actually essential for business needs, in which case the personal information subject must be separately informed of the purpose, types of biometrics involved, identification of the recipient and its data security capacity and the personal information subject consent must be explicitly obtained.

China has adopted the World Intellectual Property Organization (WIPO) Performances and Phonograms Treaty.

China instituted a licensing system for online taxi companies, which requires that personal information and business data should be stored and used in mainland China and must not be transferred outside of China (Art. 27 of the Interim Measures for the Administration of Online Taxi Booking Business Operations and Services). Such information should be retained for two years, except when otherwise required by other laws and regulations. The Measurement also states that taxi companies' servers should be set up in Mainland China, with a network security management system and technical measures for security protection in compliance with regulations (Art. 5.2).

According to Art. 25 of the Chinese government’s 2015 National Security Law, all information systems in China must be "secure and controllable". As a result of this policy, it is reported that every company operating in China – whether domestic or foreign – is required to provide the Chinese government with access to its source code, encryption keys, and backdoor access to their computer networks in China.

Art. 39 of the Cybersecurity Law requires that personal information and important data collected or generated by operators of critical information infrastructure within mainland China be stored domestically, and allows their transfer abroad only when genuinely necessary for business purposes and subject to a security assessment conducted in accordance with measures issued jointly by the national cybersecurity and informatization authority and relevant State Council departments, unless other laws provide otherwise. Art. 33 defines critical information infrastructure to include sectors such as public communications and information services, energy, transport, water, finance, public services, and e‑government, as well as any infrastructure whose damage, loss of function, or data leakage could seriously endanger national security, public welfare, or the public interest. Art. 7 of the Provisions on Promoting and Regulating the Cross-Border Flow of Data requires data handlers to apply for a data export security assessment when critical information infrastructure operators export personal information or important data, but Art. 5 exempts certain transfers of personal information, though not important data, where the transfer is genuinely necessary for the performance of a contract, for lawful cross-border human resources management, or for emergency protection of life, health, or property. Art. 10 obliges data handlers exporting personal information to provide notice, obtain separate consent, and conduct a personal information protection impact assessment, and Art. 11 further requires them to fulfil data security obligations and adopt technical and other necessary measures to ensure the security of exported data.

The Law Against Unfair Competition of the People’s Republic of China and the Provisions on Prohibiting Infringement of Trade Secrets constitute an effective legal framework for the protection of trade secrets. In addition to these two primary instruments, the broader system governing undisclosed information and trade secrets is further supported by the Administrative Licensing Law, the Criminal Law, the Labour Law and other relevant legislation.
Despite the existence of this framework, reports indicate that significant enforcement challenges persist. These challenges include stringent evidentiary requirements, limited opportunities for discovery and difficulties in meeting the demanding conditions necessary to enforce agreements intended to safeguard trade secrets and confidential business information from misappropriation. Stakeholders also observe that securing damages awards at levels sufficient to deter infringement remains difficult. Furthermore, there are continuing concerns about the risk of unauthorised disclosure of trade secrets and confidential information by government officials and third‑party experts. This issue is considered particularly acute in sectors such as software.

According to Art. 13 of the "Measures for the Management of Scientific Data," any scientific data generated within the framework of a project supported by Chinese public funds must be collected by the entity responsible for the research project and subsequently submitted to the relevant designated scientific data centre, as specified by the Ministry of Science and Technology, for archiving and processing. Art. 14 stipulates that when scientific data produced within the framework of a project funded by Chinese public funds is to be disseminated outside China for the purpose of producing an academic paper to be published in a foreign journal, the data must first be submitted to the Chinese research institute where the author is employed. The institute’s management must approve the data before the paper can be published. The Measures also impose general obligations applicable to all scientific data, irrespective of whether they are funded by the Chinese government. Specifically, Art. 26 states that if it is necessary to provide a foreign party with scientific data related to state secrets in the context of international collaboration, the transfer of such data is subject to approval by the relevant authorities and the signing of confidentiality agreements between the parties involved in the research.

It is reported that there is an obligation for passive infrastructure sharing in China to deliver telecom services to end users. Moreover, passive infrastructure sharing is practised in both the mobile and fixed sectors based on commercial agreements.

Under Art. 177 of the Securities Law, the export of information pertaining to securities operations to overseas entities is contingent upon obtaining approval from the China Securities Regulatory Commission and other relevant authorities of the State Council.

Art. 6 of the "Administrative Provisions on Foreign‑funded Telecommunications Enterprises" stipulates that, unless otherwise prescribed by the State, the aggregate equity held by foreign investor(s) in a foreign‑funded telecommunications enterprise engaged in basic telecommunications services, excluding radio paging services, may not ultimately exceed 49%, and the "Classification Catalogue of Telecommunications Services" identifies all categories of basic telecommunications services that fall within the scope of this restriction.

It is reported that the government holds equity stakes in several telecommunications enterprises. In particular, state ownership represents 75.15% of shares in China Telecom, 70.42% in China Mobile, 51.7% in China Unicom, and 100% in China Broadnet.

It is reported that China does not mandate functional or accounting separation for operators with significant market power (SMP) in the telecom market.

Pursuant to Art. 7 of the Telecommunications Regulations, the State is required to implement a licensing regime for telecommunications enterprises in accordance with the categorisation of telecommunications services, which, as set out in the Appendix to the Regulations, includes basic telecommunications services. Art. 5.6 of the Administrative Measures on Telecommunications Business Permits further provides that the minimum registered capital for an operator conducting business within a single province, autonomous region, or centrally administered municipality is RMB 100 million (approx. USD 14.5 million), whereas operators providing services nationwide or across multiple such jurisdictions must have a minimum registered capital of RMB 1 billion (approx. USD 145 million). Under Art. 8 of the Telecommunications Regulations, basic telecommunications services are defined as the provision of public network infrastructure, public data transmission services, and basic voice communication services. It is reported that China’s restrictions on basic telecommunications services, including for example the imposition of very high capital requirements, have hindered foreign suppliers from entering the country’s basic telecommunications market.

Arts. 8 and 9 of the "Provisional Regulation of the People’s Republic of China for the Administration of International Networking of Computer Information Networks" require access entities to obtain a licence prior to engaging in either operational or non-operational activities involving international networking, which, under Art. 3, is defined as the connection of domestic computer information networks with foreign networks for the purpose of international information exchange. Art. 6 additionally mandates that any computer information network directly engaging in international networking must rely solely on the international inbound and outbound channels provided by the national public telecommunications network; no entity or individual is permitted to establish independent channels or to utilise any alternative channels for international connectivity.