Chinese law may require companies to disclose cyber-security preparations outside China

Yan Luo is quoted in Computer Weekly regarding China’s new draft data security law. Ms. Luo says, “China is considering allowing the law to have an extra-territorial effect that we have not seen before. They want to counteract the extra-territorial effect of U.S. law.”

She adds that the law may require a technical audit of a company’s cyber security and to consider whether, for example, overseas firms are complying with U.S. sanctions that could damage China’s national security. She says, “It’s not just a technical review of what protections you have put in place, it could be political elements.” However, the draft law is likely to change significantly as it undergoes review. “This law, from now until its implementation, is going to become a very different law,” she adds. “A lot of people will submit comments.”