Direct answer: Map data classes and system admin rights before SPA; test whether minority vetoes still create material influence; never run bulk PI export under a global HQ playbook.
Scope
Investments in internet products, platforms, mobility, logistics tech, and any FIE/target holding large-scale personal information or operationally sensitive datasets in China.
- Sector / asset focus: Data-heavy platforms, mobility fleets, marketplaces, SaaS with mainland user/PI/important data
- Investment forms in view: greenfield, equity M&A, asset deals, JVs, minority with governance rights
- Not covered here: outbound Chinese ODI; pure domestic Chinese deals without foreign investor
Trigger tests (screen, do not self-clear)
| Test | What to collect | Escalate when |
|---|---|---|
| Market access | Negative-list line; ownership caps; licence class | Restricted / prohibited / hybrid scope |
| NSR path | Sensitive field/asset + actual control / material influence | Control rights, key tech/data access, infra adjacency |
| Parallel gates | SAMR turnover; data/export overlays | Any “unknown” that blocks long-stop design |
Coordinate NSR screening with the data L3 route engine (SCC / assessment / certification) — different regimes, same deal calendar.
Official sources (verify current edition)
- Foreign Investment Law (FIL) — access framework
- Measures on Security Review of Foreign Investment (NDRC/MOFCOM; effective 18 Jan 2021) — control tests, 15/30/60 working-day stages, no-implementation rule
- Foreign Investment Access Negative List — current edition; Chinese text prevails over unofficial English
- PIPL, DSL, CSL and CAC cross-border data measures (see data privacy L3)
Translation policy: English is orientation unless issued as official.
Examples (hypothetical — not predictions)
- Minority + veto on data monetisation policy — control analysis required.
- On-site diligence scraping production DBs — red safe-room redesign.
Document checklist
- [ ] Sector line vs current negative list (CN edition + date)
- [ ] Asset map: PI volumes, important data candidates, admin roles, cross-border sync jobs
- [ ] Rights schedule: equity %, board, vetoes, tech/data access
- [ ] Parallel gate scores: NSR · SAMR · licence · data · export
- [ ] Diligence safe-room class (green / amber / red)
- [ ] Long-stop buffer using longest regulatory path
- [ ] Counsel handoff pack (see parent guide)
Related gates
- FDI Closing Readiness (parent)
- SAMR merger control
- Data privacy & cybersecurity
- Export control & sanctions
- Data privacy L3
FAQ
Is data localisation the same as NSR?
No. Localisation and transfer rules are data-law gates; NSR is security screening of the investment. Both can apply.
Can we diligence freely in a VDR?
Only with a protocol. Use red/amber/green classes from the parent guide.