On 30 September 2024, China's State Council announced the finalizedRegulation for theAdministration of Network Data Security(《网络数据安全管理条例》, "Network Data Regulation"), which will take effect on 1 January 2025. This regulation provides a framework for personal information (PI) protection, cross-border data transfers, network data security management and the responsibilities of internet platform providers.

In this article, we draw on our experience in advising foreign-funded banks on PI protection policies and cross-border data transfers, to outline the key provisions of the regulations, their implications for the operations of these banks and their clients, and to provide guidance on how to align with the new regulatory requirements.