China’s laws and regulations in the field of cyberspace have apply to all entities and individuals operating from within mainland China. EU firms with legal presence in the country have to fulfil all the obligations mandated by China’s legal framework. At the same time, existing laws and regulations have an extraterritorial reach, which applies to overseas entities based abroad in case:

• Data processing activities outside the territory of China might be detrimental to the China’s national security, public interest or rights of its citizens and organisations (Data Security Law, Art. 2).
• Entities outside the territory of China yet processing the personal information of natural persons located within China with the aim of: providing products and services to natural persons located in China, analysing or assessing their conduct, or under any other circumstances as provided by any law regulation (PIPL, Art. 3.2).

Hence, EU SMEs falling under this scope will need to comply with Chinese laws and regulations even without a legal presence in China. A dedicated entity or representative must be appointed in China by overseas PI processors. China has established a robust framework for punishing or retaliating such cases, including the Anti-Espionage Law, the Foreign Trade Law, and Anti-Foreign Sanctions Law.

Despite this, in such cases, monitoring non-compliant cases and enforceability outside the territory of China will be challenging. But future operations within mainland China will certainly be affected.