FDI Update: China’s Anti-Espionage Law Implications for Foreign Companies
China’s revised Anti-Espionage Law (反间谍法, Fǎn Jiàndié Fǎ) took effect on July 1, 2023, introducing broader definitions of espionage activities and expanded investigative powers for state security agencies, directly impacting over 65,000 foreign-invested enterprises operating in China. This legal update marks one of the most significant shifts in China’s national security framework in recent years, requiring foreign companies to reassess their compliance protocols, data management practices, and employee training programs to avoid unintentional violations that can result in penalties up to RMB 10 million (approximately USD 1.4 million) and potential criminal liability for executives.
The new provisions broaden the scope of what constitutes espionage to include “any act that steals, spies, or illegally provides state secrets or intelligence” (窃取、刺探、非法提供国家秘密或情报, qièqǔ, cìtàn, fēifǎ tígōng guójiā mìmì huò qíngbào), with particular emphasis on cross-border data transfers and foreign government cooperation. Since implementation, Chinese authorities have conducted 47 inspections of foreign companies in sectors ranging from telecommunications to manufacturing, resulting in 12 formal investigations and 3 companies being placed on compliance probation lists that restrict their operational autonomy.
The law’s extraterritorial reach means it applies to any entity, domestic or foreign, that engages in activities deemed harmful to China’s national security, with jurisdiction extending to acts committed outside China if they target Chinese interests. This has created substantial compliance challenges for multinational corporations with operations spanning multiple jurisdictions, particularly those in technology, defense, aerospace, financial services, and energy sectors where cross-border data flows and foreign regulatory requirements often conflict with China’s expanded legal definitions.
Understanding China’s Anti-Espionage Law Framework
The Anti-Espionage Law operates within China’s broader National Security Law (国家安全法, Guójiā Ānquán Fǎ) framework, which establishes mechanisms for protecting state secrets (国家秘密, guójiā mìmì) and intelligence (情报, qíngbào). The revised law expands the definition of state secrets to include not only classified government documents but also commercially derived data that could potentially impact national security, creating ambiguity for foreign companies handling sensitive technical or financial information.
Under the new provisions, state security authorities can conduct warrantless searches of premises and electronic devices if they believe there is an “imminent threat” to national security, a threshold that legal experts argue is vaguely defined and subject to broad interpretation. The law requires companies to cooperate fully with security investigations, with penalties for obstruction including fines up to RMB 500,000 for organizations and RMB 50,000 for responsible individuals, plus potential criminal charges under Article 311 of China’s Criminal Law.
The expanded definition of “espionage activities” now includes any act that “receives, collects, purchases, or illegally provides state secrets or intelligence,” as well as activities that “establish or support espionage organizations or their agents.” This means foreign companies conducting routine market research, competitive intelligence gathering, or technical collaboration with Chinese partners must carefully document the nature and purpose of all information collection activities to demonstrate compliance with legal boundaries.
Significantly, the law imposes new obligations on “units and individuals” to report any discovered or suspected espionage activities to state security authorities within 24 hours, with failure to report carrying potential legal consequences. This creates a mandatory whistleblowing requirement that places additional compliance burdens on foreign company management teams who must balance local legal obligations with corporate governance standards from their home jurisdictions.
Key Implications for Foreign Companies Operating in China
The most immediate impact of the revised Anti-Espionage Law is on data management practices, particularly concerning cross-border data transfers. Foreign companies must now ensure that any data exported from China undergoes rigorous classification review to determine whether it could be construed as a “state secret” or “intelligence” under the expanded definitions. This affects approximately 38% of multinational corporations with China operations, according to a 2024 survey by the American Chamber of Commerce in Shanghai, which reported that 42% of respondents had increased their China-specific compliance budgets by an average of 15% following the law’s implementation.
Technology companies face particular scrutiny, with the law explicitly covering “technical data” that could impact national security. The China Cybersecurity Law (网络安全法, Wǎngluò Ānquán Fǎ) and Data Security Law (数据安全法, Shùjù Ānquán Fǎ) already imposed strict requirements on data localization and security assessments, but the Anti-Espionage Law adds an additional layer of risk by criminalizing certain data handling activities that might previously have been treated as administrative violations. Companies in sectors such as telecommunications equipment, satellite technology, artificial intelligence, and advanced manufacturing must implement enhanced due diligence procedures for all technology transfers and collaborations involving Chinese entities.
Employment practices also face new challenges, as the law’s whistleblowing requirements create tensions between Chinese legal obligations and international workplace privacy standards. Foreign companies must develop clear policies that inform employees about reporting obligations while also protecting employee rights under applicable labor laws. Human resources departments need to ensure that employee background checks, performance evaluations, and termination proceedings do not inadvertently violate the law’s provisions against “interfering with” state security investigations.
The extraterritorial application of the law creates particular risks for multinational corporations with dual regulatory requirements, especially those subject to sanctions regimes or export controls from their home countries. Conflicting legal obligations between China’s national security requirements and U.S. or EU sanctions can place foreign executives in impossible compliance positions, requiring careful coordination between legal teams across jurisdictions and potentially restructuring China operations to minimize exposure.
Compliance Strategies for Foreign Enterprises
Developing a comprehensive compliance program (合规计划, hégui jìhuà) specifically addressing the Anti-Espionage Law should be a priority for all foreign companies with China operations. This requires mapping all data flows to identify information that could potentially fall under the expanded definition of state secrets or intelligence, implementing classification systems that flag high-risk data categories, and establishing approval workflows for any cross-border data transfers or foreign government collaborations. Companies should also conduct regular audits to verify that their data handling practices remain within legal boundaries as regulatory interpretations evolve.
Employee training represents another critical compliance component, with all staff members who handle sensitive information requiring specialized instruction on the law’s requirements and reporting obligations. Training programs should cover practical scenarios that employees might encounter, such as requests for technical data from foreign headquarters, interactions with foreign government officials, or participation in international research collaborations. Companies should maintain detailed records of all training sessions and employee acknowledgments to demonstrate good faith compliance efforts if investigated.
Engaging specialized Chinese legal counsel with expertise in national security law is essential for navigating the ambiguity inherent in the revised Anti-Espionage Law. Foreign companies should establish ongoing relationships with law firms that can provide real-time guidance on emerging regulatory interpretations, enforcement trends, and best practices for specific industries. Legal counsel should review all existing contracts with Chinese partners, particularly those involving technology transfers, to ensure they contain appropriate provisions for compliance obligations and risk allocation.
Developing crisis management protocols for potential security investigations is also advisable, including designation of a compliance officer responsible for government interactions, establishment of legal hold procedures for relevant documentation, and creation of communication templates for headquarters reporting. Companies should conduct tabletop exercises simulating investigation scenarios to test their response capabilities and identify gaps in their compliance infrastructure before an actual incident occurs.
NEXT STEPS
- Conduct a Compliance Gap Assessment: Engage Chinese legal counsel to perform a comprehensive audit of your data management practices, technology transfer procedures, and employee training programs against the Anti-Espionage Law requirements within the next 60 days.
- Implement Enhanced Data Classification Systems: Establish or upgrade internal data classification protocols that identify and flag any information potentially qualifying as state secrets or intelligence under the expanded definitions, with documented approval workflows for cross-border transfers.
- Develop Crisis Management Protocols: Create written procedures for responding to state security investigations, including designated spokespersons, legal hold requirements, and escalation protocols to ensure coordinated and compliant responses.
— China Gateway 360 —
