§ READING MAP
Read by theme, not by date.
36 briefings, organized into reading tracks that follow the structure of the regime. Each brief can sit in more than one track — that's how the topics actually connect.
New to the Chinese data regime? Begin with the Overview — a five-minute visual intro to the foundation laws, the regulators, and the Subject × Object framework. Then pick a track below. To see how everything connects, open the knowledge graph.
Data rights & the data-element market .
18 BRIEFSThe Data 20 Articles world: structural separation of data property rights (hold / use / operate), the data-source's right, data brokery, data trading and registration, and data-as-asset. Start here if you're trying to understand how China is building a market for data.
- Datatang v. Yinmu — China's First Ruling on a Data-IP Registration Certificate, and Why Open-Sourced Data Is Still Protected ★
- Reviving a Zombie Provision — Xu Ke's Concentric-Circle Reconstruction of the Anonymization Regime ★
- Tang Linyao — Data-Broker Derivative Harms and the 'Data Integration Analysis Framework' ★
- Wang Nian — Data Source's Rights as a 'Fair Use' Right Alongside the Three Rights ★
- NDA Explains the Three-Rights Framework — A Plain-Language Walk-Through from the Regulator Itself ★
- Cold Water on 'Token Trading' — Wang Qinglan on the NDA's High-Quality Data Set Initiative ★
- Will Judicial Review 'Reset' the Data Registration Rush? — Reading Wang Qinglan on the SPC's New Data Disputes Case Category ★
- Mutual Trust Mechanisms for Cross-Border Data Flow — China's 'Trusted Data Space' Bet ★
- What Is Data, Really? — A Plain-Language Primer on Rules and Compliance ★
- Data Governance vs. Data Management vs. Data Compliance — A Plain-Language Disambiguation ★
- What Does Data Registration Actually Confirm? — A Doctrinal Reading ★
- On-Exchange vs. Off-Exchange Data Trading — A Uniquely Chinese Market Structure ★
- What Is Actually Traded on China's Data Exchanges — A Bakery Metaphor ★
- Case Study — A Public-Data Operator Hands Personal Data to a Bank. Two Compliance Failures. ★
- The 'Rights Block' — Xu Ke's Structural Theory Behind China's Data-Property Framework
- When Does Data Become an Asset? Xu Ke on Identifying and Defining Data Assets
- Who Is the 'Data Processor' Under the Three-Rights Framework — NDA's Farm-Equipment Hypothetical
- Cloud, BPO, and Other Entrusted-Processing Arrangements: Why the Processor Doesn't Get the Rights
Personal information .
20 BRIEFSPIPL and the personal-information regime: lawful bases, the PIPO role, the criminal threshold, anonymization (the gateway out of PIPL scope), and the harder edge cases — platform gig workers, GenAI causation.
- Reviving a Zombie Provision — Xu Ke's Concentric-Circle Reconstruction of the Anonymization Regime ★
- From 'Cannot Be Restored' to 'Difficult to Restore' — TRIMPS on Whether Anonymization Is Absolute, and Whether It's Recipient-Relative ★
- Zhu Xiaofeng — Who Pays When GenAI Causation Is Unclear? Applying Civil Code Article 1254 by Analogy ★
- Tang Linyao — Data-Broker Derivative Harms and the 'Data Integration Analysis Framework' ★
- Wang Nian — Data Source's Rights as a 'Fair Use' Right Alongside the Three Rights ★
- Seven Lessons for Data Compliance Teams from the SAMR 'Ghost Takeout' Series — 3.5 Billion Yuan, 9-Month Suspensions, and the Per-Merchant Aggregation Doctrine ★
- Mapping the AI Agent Risk Surface — A Ten-Category Taxonomy Under China's New 智能体新规 ★
- Operationalizing AI Agent Governance — A Ten-Step Internal Control Framework ★
- Open-Source Does Not Mean Open Data — Zhang Ping on Training-Data Compliance for Open-Source AI ★
- MIIT Public-Naming Bulletin 2026 Batch 3 (Total Batch 56): 31 Apps and SDKs Cited for PI Violations and Window-Redirect Abuse ★
- When PIPL Violation Becomes a Crime — Hong Yanqing on China's Personal Information Criminal Threshold ★
- When Is Facial Recognition in a Public Place 'Necessary for Public Security'? Hong Yanqing's Four-Element Framework ★
- China's Cybersecurity Law Just Got Teeth — The 2025 Amendment and What Changed ★
- PIPO vs. DPO — How China's Personal Information Protection Officer Differs from the GDPR Data Protection Officer ★
- Reading the FRT Application Measures — What the 100k-Record Filing Threshold Actually Triggers ★
- Case Study — A Public-Data Operator Hands Personal Data to a Bank. Two Compliance Failures. ★
- The 'Rights Block' — Xu Ke's Structural Theory Behind China's Data-Property Framework
- When Does Data Become an Asset? Xu Ke on Identifying and Defining Data Assets
- Ai Lin — Why Platform Gig Workers Need PI-Protection Tilt and How to Build It
- Who Is the 'Data Processor' Under the Three-Rights Framework — NDA's Farm-Equipment Hypothetical
AI governance .
07 BRIEFSThe fast-moving AI layer: the Agent Rules and their risk/governance frameworks, open-source training-data compliance, and liability when GenAI causation is unclear.
- Zhu Xiaofeng — Who Pays When GenAI Causation Is Unclear? Applying Civil Code Article 1254 by Analogy ★
- Mapping the AI Agent Risk Surface — A Ten-Category Taxonomy Under China's New 智能体新规 ★
- Operationalizing AI Agent Governance — A Ten-Step Internal Control Framework ★
- Open-Source Does Not Mean Open Data — Zhang Ping on Training-Data Compliance for Open-Source AI ★
- Why China Used Foreign Investment Security Review on Manus — Not Tech or Data Export ★
- Cold Water on 'Token Trading' — Wang Qinglan on the NDA's High-Quality Data Set Initiative ★
- When Is Facial Recognition in a Public Place 'Necessary for Public Security'? Hong Yanqing's Four-Element Framework ★
Data security & classification .
19 BRIEFSThe DSL spine: data classification and grading, the important-data tier and how to identify it, anonymization as a security process, and the technical-standards layer.
- Datatang v. Yinmu — China's First Ruling on a Data-IP Registration Certificate, and Why Open-Sourced Data Is Still Protected ★
- Reviving a Zombie Provision — Xu Ke's Concentric-Circle Reconstruction of the Anonymization Regime ★
- From 'Cannot Be Restored' to 'Difficult to Restore' — TRIMPS on Whether Anonymization Is Absolute, and Whether It's Recipient-Relative ★
- Zhu Xiaofeng — Who Pays When GenAI Causation Is Unclear? Applying Civil Code Article 1254 by Analogy ★
- Tang Linyao — Data-Broker Derivative Harms and the 'Data Integration Analysis Framework' ★
- Seven Lessons for Data Compliance Teams from the SAMR 'Ghost Takeout' Series — 3.5 Billion Yuan, 9-Month Suspensions, and the Per-Merchant Aggregation Doctrine ★
- Mapping the AI Agent Risk Surface — A Ten-Category Taxonomy Under China's New 智能体新规 ★
- Operationalizing AI Agent Governance — A Ten-Step Internal Control Framework ★
- Open-Source Does Not Mean Open Data — Zhang Ping on Training-Data Compliance for Open-Source AI ★
- NDA Explains the Three-Rights Framework — A Plain-Language Walk-Through from the Regulator Itself ★
- 'Important Data' Is a Category, Not a Tier ★
- China's Cybersecurity Law Just Got Teeth — The 2025 Amendment and What Changed ★
- How to Identify 'Important Data' — A Plain-Language Method from Wang Qinglan ★
- What Is Data, Really? — A Plain-Language Primer on Rules and Compliance ★
- Data Governance vs. Data Management vs. Data Compliance — A Plain-Language Disambiguation ★
- FTZ Data Export Negative Lists — How 17 Sectors Across Seven Provinces Now Identify Important Data ★
- The 'Rights Block' — Xu Ke's Structural Theory Behind China's Data-Property Framework
- Who Is the 'Data Processor' Under the Three-Rights Framework — NDA's Farm-Equipment Hypothetical
- Cloud, BPO, and Other Entrusted-Processing Arrangements: Why the Processor Doesn't Get the Rights
Cross-border data .
07 BRIEFSGetting data across the border: the assessment / SCC / certification paths, FTZ negative lists, the important-data choke point, cross-border discovery, and the trusted-data-space experiments.
- From 'Cannot Be Restored' to 'Difficult to Restore' — TRIMPS on Whether Anonymization Is Absolute, and Whether It's Recipient-Relative ★
- 'Important Data' Is a Category, Not a Tier ★
- Why China Used Foreign Investment Security Review on Manus — Not Tech or Data Export ★
- Cross-Border Data Discovery — How the U.S., EU, and China Each Play Offense and Defense ★
- Mutual Trust Mechanisms for Cross-Border Data Flow — China's 'Trusted Data Space' Bet ★
- How to Identify 'Important Data' — A Plain-Language Method from Wang Qinglan ★
- FTZ Data Export Negative Lists — How 17 Sectors Across Seven Provinces Now Identify Important Data ★
Enforcement .
10 BRIEFSWhat the regulators actually police: MIIT's batched app naming, SAMR's platform penalties, the criminal tier. See the live chronicle on the Enforcement tracker.
- Seven Lessons for Data Compliance Teams from the SAMR 'Ghost Takeout' Series — 3.5 Billion Yuan, 9-Month Suspensions, and the Per-Merchant Aggregation Doctrine ★
- MIIT Public-Naming Bulletin 2026 Batch 3 (Total Batch 56): 31 Apps and SDKs Cited for PI Violations and Window-Redirect Abuse ★
- When PIPL Violation Becomes a Crime — Hong Yanqing on China's Personal Information Criminal Threshold ★
- When Is Facial Recognition in a Public Place 'Necessary for Public Security'? Hong Yanqing's Four-Element Framework ★
- Cross-Border Data Discovery — How the U.S., EU, and China Each Play Offense and Defense ★
- Will Judicial Review 'Reset' the Data Registration Rush? — Reading Wang Qinglan on the SPC's New Data Disputes Case Category ★
- PIPO vs. DPO — How China's Personal Information Protection Officer Differs from the GDPR Data Protection Officer ★
- Reading the FRT Application Measures — What the 100k-Record Filing Threshold Actually Triggers ★
- What Does Data Registration Actually Confirm? — A Doctrinal Reading ★
- Case Study — A Public-Data Operator Hands Personal Data to a Bank. Two Compliance Failures. ★