In 2026, Chinese regulators have continued to enforce existing data laws in a more targeted and fact-specific manner. Recent cases and enforcement actions show three clear enforcement priorities: cross-border transfers of personal information; data collection and use by mobile applications (apps) and embedded Software Development Kits (SDKs); and data security incidents.

These developments indicate a focus on operational accountability. Regulators are increasingly ­examining whether companies’ actual cross-border data flows remain within approved scopes, whether App and SDK practices fully implement privacy requirements, and whether companies have employed effective data security controls to prevent security incidents.