THE EMERGENCE OF DIGITAL TRADE GOVERNANCE: CHINA'S REGULATORY RESPONSE TO U.S. DATA SECURITY AND DIGITAL TRADE BARRIERS

ABSTRACT

Background. Since 2018, escalating United States restrictions on semiconductor exports, cross-border data flows, and Chinese-owned digital platforms have prompted China to construct a comprehensive domestic legal architecture for digital trade and data governance. This article examines how that architecture — spanning the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law (PIPL), and a parallel set of retaliatory instruments — has evolved from a defensive, sovereignty-oriented posture into a more calibrated regime that combines security control with selective liberalization. Methods. The article applies a qualitative, literature- and document-based policy analysis, drawing on primary regulatory texts, law-firm regulatory advisories, and peer-reviewed and policy-institute literature on digital trade governance, data sovereignty, and U.S.–China technology competition published between 2019 and 2026. Results. The analysis identifies three overlapping regulatory tracks: (i) a domestic data-security stack (Cybersecurity Law, Data Security Law, PIPL, and the 2024 Network Data Security Regulation) that has progressively relaxed routine cross-border transfer requirements while tightening control over «important data»; (ii) a retaliatory-countermeasure stack (the Unreliable Entity List, Export Control Law, Anti-Foreign Sanctions Law, and 2026 anti-extraterritoriality regulations) built explicitly in response to U.S. export controls and secondary sanctions; and (iii) an outward-facing liberalization track (the 2024 cross-border data flow framework, free-trade-zone «negative lists,» and applications to join the CPTPP and DEPA) intended to position China as a rule-shaper rather than merely a rule-taker in global digital trade governance. Conclusion. China's regulatory response does not reduce to simple defensiveness or simple retaliation; it reflects a dual strategy of consolidating domestic control over data as a strategic asset while simultaneously seeking a seat at the table in shaping the multilateral and plurilateral rules that will govern digital trade, with the durability of the more liberal track remaining contingent on the broader trajectory of U.S.–China trade relations.

Keywords: digital trade governance; data security; cross-border data flow; Personal Information Protection Law; export controls; Unreliable Entity List; digital sovereignty; U.S.–China trade relations; CPTPP; DEPA.

Introduction

Digital trade — the cross-border flow of data, digitally delivered services, and data-dependent goods — has become both an engine of economic growth and a domain of strategic contest between the United States and China. Beginning with the 2018 tariff disputes and intensifying through successive rounds of semiconductor export controls, tariff escalation, and platform-specific restrictions, U.S. policy has treated Chinese control over cross-border data and advanced computing as a national-security concern rather than a purely commercial one [1]. China's response has not been a single law or a single retaliatory act, but the construction of an increasingly dense regulatory architecture that simultaneously defends domestic data sovereignty, retaliates against extraterritorial U.S. measures, and seeks to reposition China as a legitimate co-author of global digital trade rules.

The scale of the underlying commercial relationship makes the stakes concrete. U.S. tariffs on Chinese-origin servers and computing equipment reached combined rates exceeding 100 per cent at their peak in April 2025 under layered Section 301 and IEEPA authorities, and China's share of U.S. data-center equipment imports fell from 41 per cent in 2020 to 11 per cent in 2025 as supply chains relocated to Taiwan, Mexico, and Vietnam [2]. At the same time, Chinese regulators have processed hundreds of cross-border data transfer applications under an evolving three-pathway framework — security assessment, standard contractual clauses, and certification — while introducing broad exemptions for routine business data in 2025 [3]. This juxtaposition of hardening trade barriers and softening data barriers is the empirical puzzle this article addresses.

The objective of the article is twofold: first, to map the principal instruments through which China has responded to U.S. data-security and digital-trade restrictions since 2017; and second, to interpret the pattern that these instruments jointly reveal — namely, a shift from a purely defensive posture of data sovereignty toward a dual-track strategy that pairs continued security control over strategically sensitive data with selective liberalization intended to support China's accession bids to plurilateral digital trade frameworks.

Theoretical Framework

The literature on digital trade governance identifies three broad regulatory philosophies competing for global influence: a market-liberal model associated with the United States, which historically favored minimal restriction on cross-border data flow; a rights-based model associated with the European Union's General Data Protection Regulation (GDPR), which subordinates data flow to individual privacy protection; and a sovereignty-based model associated with China, which treats data as a strategic national asset subject to state control [4]. Meltzer's account of digital trade governance argues that an effective international regime requires both binding trade rules — whether multilateral, through the WTO, or plurilateral, through instruments such as the CPTPP — and regulatory cooperation mechanisms that give governments confidence that permitting data to cross borders will not undermine domestic policy objectives such as privacy or cybersecurity [5]. This framework is useful because it separates two functions that are often conflated in popular commentary on U.S.–China «decoupling»: the function of restricting trade (tariffs, export controls, entity lists) and the function of governing data (localization, transfer assessment, certification). China's regulatory response operates on both dimensions simultaneously but not symmetrically.

Within this framework, the working propositions guiding the analysis are as follows. P1: U.S. restrictions targeting Chinese digital trade have prompted the construction of a distinct Chinese counter-measure architecture that mirrors, rather than merely reacts to, the extraterritorial structure of U.S. sanctions and export-control law. P2: China's domestic data-security regime has evolved from restriction toward calibrated relaxation for routine commercial data, even as control over «important data» and strategically sensitive sectors has tightened. P3: China's pursuit of accession to plurilateral digital trade agreements (CPTPP, DEPA) functions as a rule-shaping strategy that is in some tension with its domestic data-sovereignty commitments, creating a distinctive form of institutional friction documented in recent trade-law scholarship [6].

Materials and Methods

This article uses a qualitative document-analysis method rather than statistical estimation, reflecting the nature of the research question: mapping and interpreting a regulatory architecture rather than measuring its quantitative trade effects. The evidence base comprises three categories of sources: (i) primary regulatory instruments and their official summaries, including the Cybersecurity Law (2017), the Data Security Law (2021), the Personal Information Protection Law (2021), the Regulation on Network Data Security (effective 1 January 2025), and the 2025 Measures for Certification of Cross-Border Personal Information Transfer; (ii) contemporaneous legal and policy analysis published by international law firms and compliance advisories tracking implementation and enforcement between 2024 and 2026; and (iii) peer-reviewed and policy-institute scholarship on digital trade governance, data sovereignty, and U.S.–China technology competition.

Sources were triangulated chronologically to distinguish enduring structural features of China's regulatory response from transient tactical moves tied to specific negotiating rounds (for example, the temporary 90-day suspension of Unreliable Entity List measures announced in May 2025 following the Geneva talks). Because U.S.–China trade policy has continued to shift rapidly through 2026, including a partial recalibration of U.S. chip export enforcement, the analysis distinguishes instruments that represent settled legal architecture from those that remain provisional or contingent on the state of bilateral negotiations.

Results

Track One: the domestic data-security stack. China's three foundational data statutes — the Cybersecurity Law (2017), the Data Security Law (2021), and the PIPL (2021) — together establish data classification, cross-border transfer control, and personal-information protection obligations. Of the three, only the Data Security Law and the PIPL carry extraterritorial reach: PIPL Article 3 extends the law to processing conducted outside China where the purpose is to provide products or services to individuals in China, or to analyze or evaluate their behavior, a formulation that closely parallels Article 3(2) of the EU's GDPR [7]. The September 2024 Regulation on Network Data Security, effective 1 January 2025, consolidated cross-border transfer rules into three pathways — government security assessment, filed standard contractual clauses, and third-party certification — and the October 2025 Measures for Certification of Cross-Border Personal Information Transfer completed this three-pathway framework by formalizing the certification route [8]. Enforcement data released by the Cyberspace Administration of China (CAC) in April 2025 indicate that of 298 security-assessment applications reviewed by that point, 44 involved «important data,» of which 63.9 per cent of individual data items were approved for export and 15.9 per cent of applications overall were rejected [9] — evidence of a functioning, if selective, approval regime rather than a blanket prohibition.

Notably, this stack has moved toward relaxation for routine commercial data. In September 2025, the CAC exempted many routine business data transfers — human-resources records, procurement data, and other non-sensitive operational data — from security assessment altogether, adopting a negative-list logic under which only enumerated categories require review and everything else is presumptively permitted [10]. Multiple provincial and municipal free-trade zones (Tianjin, Beijing, Shanghai, Fujian, Jiangsu, Chongqing, Zhejiang, and Hainan) have since 2024 published their own positive or negative data lists, allowing companies operating within a zone to reference the most permissive applicable list [3]. This pattern is consistent with Proposition P2: the domestic regime is not a monolithic barrier but a graduated system that has become markedly less restrictive for the overwhelming majority of ordinary commercial data flows while important data and platform-scale personal information remain tightly controlled — as illustrated by a September 2025 enforcement action against the Shanghai subsidiary of a European luxury brand for unauthorized overseas transfer of personal information following a data breach [11].

Track Two: the retaliatory-countermeasure stack. Distinct from the data-protection statutes is a second, explicitly retaliatory legal architecture built to counter the extraterritorial reach of U.S. export controls and sanctions. Its core instruments are the Unreliable Entity List (established 2020, administered by the Ministry of Commerce), the Export Control Law (2020), the Anti-Foreign Sanctions Law (2021, administered by the Ministry of Foreign Affairs), the 2021 Blocking Rules against unjustified extraterritorial application of foreign legislation, and — most recently — the 2026 Counter-Extraterritorial Jurisdiction Regulation (Decree 835) and accompanying Supply Chain Security Provisions (Decree 834) [12]. Analysts at the 2026 countermeasures regulation is widely read as functionally analogous to the European Union's own blocking statute, first enacted in 1996 and expanded in 2018 to shield European firms from the extraterritorial reach of U.S. secondary sanctions; recent legal commentary observes that Beijing now treats the EU and U.S. pressure environments as a single regulatory challenge rather than two separate poles, exposing European operators that already reconcile EU and U.S. compliance obligations to a third, conflicting jurisdictional vector [13].

The escalation sequence illustrates the tit-for-tat dynamic directly. Following the U.S. imposition of fentanyl-related IEEPA tariffs in February and March 2025, China added seventeen U.S. companies to the Unreliable Entity List in early April 2025, restricting their ability to trade, invest, or transact with Chinese partners, before agreeing to a 90-day suspension of these measures alongside a reciprocal U.S. tariff reduction following the May 2025 Geneva talks [14]. Decree 835's Malicious Entity List, introduced in 2026, extends sanctionable conduct to parties that «promote» foreign extraterritorial measures — a term broad enough to reach advisory and compliance conduct — and includes «piercing» rules that extend countermeasures to entities under common control with a listed party, materially raising compliance risk for multinational corporate structures operating in China [15]. A parallel Export Control List, modelled explicitly on the U.S. Commerce Department's Entity List, was used for the first time in 2025 against named U.S. defense and aerospace firms in connection with arms sales to Taiwan [16], confirming Proposition P1: China's countermeasure architecture does not merely react to U.S. measures but increasingly mirrors their structural logic — entity-listing, licensing control, and extraterritorial reach — turning the same regulatory instruments back on their originators.

Track Three: outward-facing liberalization and rule-shaping. The third track is the least defensive and the most oriented toward long-term influence over global digital trade rules. China's applications to join the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP) and the Digital Economy Partnership Agreement (DEPA), both submitted in 2021 and still pending, require commitments on cross-border data flow and prohibitions on data localization that sit in evident tension with China's own cross-border transfer regime [17]. China's 2024 Initiative on Cross-Border Data Flows explicitly frames the promotion of freer data flow — including through pilot free-trade-zone negative lists — as consistent with, and preparatory to, meeting CPTPP- and DEPA-level commitments, while positioning China internationally as a proponent of digital free trade rather than merely a regulator of it [10]. Scholarship on China's CPTPP and DEPA negotiations documents that Japan, Australia, Canada, and other prospective partners remain skeptical, citing the gap between China's stated liberalization and the discretionary, security-driven character of its «important data» categorization and enforcement practice [18], a friction that recent research attributes to a deeper structural conflict between a free-data-flow institutional logic and a sovereign-control institutional logic [19]. This evidence supports Proposition P3: rule-shaping ambition and domestic sovereignty commitments coexist uneasily rather than resolving into a single consistent policy stance.

Discussion

Read together, the three tracks resist a single-cause explanation. China's regulatory response to U.S. digital trade barriers is neither purely defensive nor purely retaliatory: it is better understood as a strategy of managed asymmetric opening, in which China tightens control precisely where data is judged strategically or politically sensitive (important data, platform-scale personal information, cross-border transfers implicating national security) while relaxing control precisely where doing so lowers compliance friction for ordinary multinational business and supports China's credentials as a rules-abiding participant in plurilateral trade governance. The retaliatory-countermeasure track, by contrast, operates almost entirely outside the data-protection framework and is explicitly reactive to U.S. tariff and export-control escalation, with its intensity closely tracking the state of bilateral negotiations — tightening after each new U.S. measure and loosening, often temporarily, after each negotiating breakthrough.

This pattern has three implications for the study of digital trade governance. First, it complicates the common framing of U.S.–China technology relations as simple «decoupling»: the data-governance track shows selective re-coupling (routine data flows becoming easier) occurring in parallel with the trade-and-investment track's continued decoupling (tariffs, export controls, entity lists). Second, it suggests that China's bid to join CPTPP and DEPA functions less as a genuine commitment to a market-liberal data model and more as an instrument of institutional positioning — an attempt to shape the rules of digital trade governance from within rather than accept rules authored primarily by the United States and its partners. Third, the 2026 anti-extraterritoriality regulations (Decrees 834 and 835) indicate that China is no longer content to respond to U.S. extraterritorial jurisdiction defensively; it is now constructing extraterritorial instruments of its own, which — if applied assertively — could expose multinational companies to simultaneous, conflicting compliance obligations under U.S. and Chinese law.

Three limitations qualify these conclusions. First, because the underlying legal and policy landscape has continued to change rapidly through 2026 — including a partial U.S. softening of chip export enforcement — some instruments analyzed here may already be superseded or modified by the time of publication; the article should be read as a structural map rather than a current compliance guide. Second, the qualitative document-based method used here does not permit quantification of the trade or investment effects of any single instrument; a natural extension would combine this regulatory mapping with quantitative trade-flow analysis, for example a gravity-model estimation of the effect of specific measures on bilateral digital-services trade. Third, the analysis relies substantially on legal-advisory and think-tank sources because peer-reviewed academic literature on the most recent instruments (2025–2026) has not yet caught up with the pace of regulatory change; conclusions regarding these most recent instruments should be treated as provisional.

Conclusion

This article has mapped China's regulatory response to U.S. data-security and digital-trade restrictions as three analytically distinct but operationally interlocking tracks: a domestic data-security stack that has relaxed for routine commercial data while tightening for important data; a retaliatory-countermeasure stack that increasingly mirrors the structural logic of the U.S. sanctions and export-control regime it was built to counter; and an outward-facing liberalization track aimed at securing China a rule-shaping role in plurilateral digital trade governance through CPTPP and DEPA accession. None of the three tracks alone captures the overall strategy; only together do they reveal a deliberate, asymmetric approach that trades tighter control over strategically sensitive data for lower friction elsewhere, while using entity-listing and extraterritorial countermeasures as leverage in the broader trade relationship.

The principal contribution of the article is to disaggregate what is frequently treated in policy commentary as a single undifferentiated phenomenon — «China's response to U.S. tech restrictions» — into three tracks with distinct legal bases, target audiences, and trajectories. For Kazakhstan and other third countries positioned along China's trade and data corridors, the practical implication is that engagement with Chinese digital trade partners increasingly requires separate risk assessments for data-compliance exposure (Track One), sanctions and entity-list exposure (Track Two), and the shifting rules of multilateral and plurilateral digital trade agreements to which China may eventually accede (Track Three), since a favorable position on one track carries no assurance of a favorable position on another.

References:

1. Cyberspace Administration of China, State Administration for Market Regulation. Measures for Certification of Cross-Border Personal Information Transfer [Electronic resource]. – 2025. – URL: https://www.china-briefing.com/news/china-cross-border-data-transfer-certification/ (date of access: 25.08.2026).
2. State Council of the People's Republic of China. Administrative Regulation on Network Data Security [Electronic resource] // Bird & Bird. – 2024. – URL: https://www.twobirds.com/en/insights/2025/china/an-indepth-analysis-of-chinas-network-data-security-regime-part-iii (date of access: 25.08.2026).
3. Cyberspace Administration of China. Q&A on Data Cross-Border Security Management Policies [Electronic resource] // China Briefing. – 2025. – URL: https://www.china-briefing.com/news/china-clarifies-cross-border-data-transfer-rules-official-qa/ (date of access: 25.08.2026).
4. Arnold & Porter. China Clarifies Cross-Border Data Transfer Rules: Practical Guidance for Compliance [Electronic resource]. – 2025. – URL: https://www.arnoldporter.com/en/perspectives/advisories/2025/06/china-clarifies-cross-border-data-transfer-rules (date of access: 25.08.2026).
5. Council on Foreign Relations. The U.S.-China Trade Relationship: What's Behind the Competition? [Electronic resource]. – 2026. – URL: https://www.cfr.org/backgrounders/contentious-us-china-trade-relationship (date of access: 25.08.2026).
6. Congressional Research Service. U.S. Export Controls and China: Advanced Semiconductors, R48642 [Electronic resource]. – 2025. – URL: https://www.congress.gov/crs-product/R48642 (date of access: 25.08.2026).
7. Squire Patton Boggs. China's New Countermeasures Regulation [Electronic resource]. – 2026. – URL: https://www.squirepattonboggs.com/insights/publications/china-s-new-countermeasures-regulation/ (date of access: 15.09.2026).
8. Foreign Policy. China's New Anti-Sanctions Laws Are Ensnaring Western Companies [Electronic resource]. – 2026. – URL: https://foreignpolicy.com/2026/08/17/china-sanctions-laws-companies-legal-risk-extraterritorial-trade-embargo/ (date of access: 25.08.2026).
9. Holland & Knight. China's Comprehensive Retaliation Against U.S. Tariffs [Electronic resource]. – 2025. – URL: https://www.hklaw.com/en/insights/publications/2025/04/chinas-comprehensive-retaliation-against-us-tariffs (date of access: 25.08.2026).
10. Morgan Lewis. China Issues New Regulations on Countering Foreign Extraterritorial Jurisdiction: What MNCs Need to Know [Electronic resource]. – 2026. – URL: https://www.morganlewis.com/pubs/2026/04/china-issues-new-regulations-on-countering-foreign-extraterritorial-jurisdiction-what-mncs-need-to-know (date of access: 25.08.2026).
11. Crowell & Moring LLP. China Unveils New Framework to Stimulate Cross-Border Data Flows: Risk or Opportunity for Multinational Companies [Electronic resource]. – 2025. – URL: https://www.crowell.com/en/insights/client-alerts/china-unveils-new-framework-to-stimulate-cross-border-data-flows-risk-or-opportunity-for-multinational-companies (date of access: 25.08.2026).
12. Centre for International Governance Innovation. China's Changing Approach to Digital Trade [Electronic resource]. – 2025. – URL: https://www.cigionline.org/articles/chinas-changing-approach-to-digital-trade/ (date of access: 25.08.2026).
13. Gao H. Trade Deals Might Induce Beijing to Bend on Data Restrictions [Electronic resource] // Centre for International Governance Innovation. – URL: https://www.cigionline.org/articles/trade-deals-might-induce-beijing-to-bend-on-data-restrictions/ (date of access: 25.08.2026).
14. Conflict of Laws.net. Extraterritorial Application of Chinese Personal Information Protection Law: A Comparative Study with GDPR [Electronic resource]. – 2021. – URL: https://conflictoflaws.net/2021/extraterritorial-application-of-chinese-personal-information-protection-law-a-comparative-study-with-gdpr/ (date of access: 25.08.2026).
15. Meltzer J.P. Governing Digital Trade // World Trade Review. – 2019. – Vol. 18, Special Issue S1. – P. S23–S48.
16. Wang F. Developing China's Approaches to Regulate Cross-Border Data Transfer: Relaxation and Integration // Computer Law & Security Review. – 2024. – Vol. 54. – Art. 106016.