National Security Compliance for Foreign Individuals and Research

National security compliance in China: who needs it

National security compliance in China is no longer a niche concern for defence contractors. Foreign executives gathering market intelligence, consultants conducting due diligence, academics collaborating with Chinese universities, life sciences companies running clinical studies, technology firms sharing source code, and researchers doing fieldwork can all engage laws designed to protect national security. The legal framework has expanded significantly since 2015, and enforcement authorities have publicly emphasised the risks they see in information gathering by foreign entities and individuals.

For most foreign individuals and organisations, the risk is not deliberate wrongdoing. It is the inadvertent collection or transfer of information that turns out to be sensitive, the use of methods that are routine elsewhere but restricted in China, or the involvement of local partners or interviewees who share more than they should. Good national security compliance is about recognising those situations early, designing activities to avoid them and knowing what to do if the authorities make contact.

The stakes are personal as well as corporate. Individuals can face questioning, exit restrictions or criminal investigation, and organisations can face closure of offices, seizure of materials and reputational damage. Planning is therefore a duty of care to staff as much as a legal requirement, and boards of organisations with significant China activity should expect to receive regular reporting on it.

The legal framework for national security compliance

Official texts are available on the NPC national law database. The revised Counter-Espionage Law is the instrument most often discussed by foreign businesses. Its expanded definition reaches not only state secrets and intelligence but other documents, data, materials and items relating to national security and interests, and it gives state security organs powers to inspect electronic devices, access data and restrict exit in connection with investigations.

The Foreign Relations Law, also in force since 1 July 2023, and the Anti-Foreign Sanctions Law add a broader policy context: they give the state tools to respond to measures it considers harmful to its interests, which can affect organisations involved in sanctions-related research or advocacy.

Export control and deemed exports

China's Export Control Law applies not only to shipments leaving the country but also to the provision of controlled items, including technology and data, by Chinese persons to foreign organisations and individuals. The dual-use items export control regulations, in force since 1 December 2024, consolidated the licensing framework and control lists published by the Ministry of Commerce. For research and R&D teams this means that sharing controlled technical data with foreign colleagues, even within China, may need a licence. National security compliance for technology projects should therefore include a classification of the technology involved against Chinese lists, alongside the US, EU and other lists the organisation already applies.

Surveys, statistics and mapping

Surveys of the Chinese public and market research conducted by or for foreign organisations are subject to rules on foreign-related surveys, under which such work is generally carried out through qualified domestic survey organisations, and some social surveys require approval. Surveying and mapping by foreign organisations or individuals requires approval and is generally carried out jointly with Chinese partners, and geographic information, including high-precision location data collected by vehicles or drones, is closely regulated. National security compliance for fieldwork should include a check of these requirements before data collection begins.

High-risk activities for foreign individuals and organisations

• Due diligence and market research. Interviewing current or former government officials or employees of state-owned enterprises, or seeking non-public information about strategic industries, can raise counter-espionage and state secrets questions. In 2023 the authorities publicised investigations into consulting and due diligence firms.
• Expert networks. Paid consultations with industry insiders about sensitive sectors are a recognised risk area, both for the consultants and for the clients.
• Academic and scientific collaboration. Joint research in fields such as advanced technology, biology, geography and defence-adjacent engineering may involve controlled technology, important data or human genetic resources.
• Clinical research and biobanks. Collecting, storing or exporting human genetic resources and related information is regulated, with approval or filing requirements for international collaboration.
• Fieldwork, surveys and mapping. Geographic data collection, drone photography, surveys of the public and fieldwork near sensitive sites can engage mapping, statistics and security rules.
• Technology transfer and R&D. Sharing controlled technology with foreign colleagues in China may be treated as an export under the Export Control Law.
• Photography and travel. Photographing military facilities, ports or infrastructure is prohibited, and some regions have additional restrictions.

Sector context matters too. Activities touching semiconductors, critical minerals, energy infrastructure, telecommunications, aerospace and biotechnology attract closer attention than consumer or retail work, because these are areas the state considers strategic. Organisations active in those sectors should apply a higher level of review to information gathering and data transfers, even for routine commercial purposes such as competitor benchmarking.

None of these activities is inherently unlawful, and many are carried out legitimately every day. The point is that each requires planning: understanding which rules apply, obtaining any approvals, choosing appropriate partners and methods, and limiting the collection and transfer of information to what is necessary.

Common mistakes

• Treating national security compliance as relevant only to defence or government work.
• Commissioning due diligence without reviewing the questions asked and the methods used.
• Assuming that information shared informally by an interviewee is free to use.
• Collecting biological samples or genomic data in collaborations without checking approval requirements.
• Carrying sensitive client or research data on devices taken into China.
• Having no plan for what an employee should do if contacted by the authorities.

Research collaboration and human genetic resources

Universities, hospitals and companies collaborating with Chinese partners should build national security compliance into project design. Key steps include classifying the data the project will generate, checking whether any technology involved is on Chinese or foreign export control lists, determining whether human genetic resources will be collected or used, and agreeing where data will be stored and who can access it.

Under the human genetic resources regime, foreign organisations and individuals, and entities they control, may not collect or preserve Chinese human genetic resources in China, and international scientific collaboration using such resources requires approval or filing, depending on the activity. Providing related information abroad may also require filing or security review. The implementing rules that took effect on 1 July 2023 clarified several points, including the treatment of foreign-controlled entities, and administration of the regime passed from the Ministry of Science and Technology to the National Health Commission in 2024. Pharmaceutical and medical device companies should integrate these requirements into clinical trial planning; see pharmaceuticals and health and medical data.

Research data more generally may fall within the important data regime or within rules on scientific data that restrict provision abroad where national security is involved. Ethics review rules for science and technology activities may also apply. Collaboration agreements should allocate responsibility for these compliance steps and include mechanisms to pause or modify projects if rules change.

Consider a multinational sponsor planning a multi-regional clinical trial with Chinese sites. Before the protocol is finalised, it maps which samples and data will be collected in China, whether any samples will be tested outside China, and whether genomic analysis is involved. It then determines whether approval or filing is needed, which party will make the application, and how long that will take. Building these steps into the trial timeline from the outset avoids the delays that arise when they are discovered after sites have been selected.

Foreign research security rules

Research organisations must also satisfy their home governments. The United States has introduced research security requirements for federally funded institutions, the United Kingdom operates academic technology approval for certain foreign researchers and screens sensitive investments, and the European Union has issued guidance on tackling foreign interference in research and innovation. These rules can restrict who may join projects, what may be shared and with whom. National security compliance programmes for international collaborations therefore need to reconcile Chinese and foreign requirements, which sometimes point in different directions.

National security compliance for foreign individuals in China

Individuals travelling to or living in China should understand some basic points. Electronic devices may be inspected in connection with national security investigations, so travellers should carry only the data they need and avoid holding sensitive client or research information on personal devices. Meetings with officials or state-owned enterprise staff should have a clear business purpose and should not seek non-public information. Individuals should be cautious about requests from acquaintances to obtain documents or information, and should report unusual approaches to their organisation, which should have a confidential channel for doing so.

Exit restrictions are a particular concern. Foreign nationals who are suspects or defendants in criminal cases, parties to certain civil disputes or involved in matters the authorities consider unresolved may be prevented from leaving China. If an individual is questioned by state security organs, they should remain calm, ask to contact their employer and consulate, and seek legal advice from licensed PRC counsel. See criminal defence for how the criminal process works.

A worked example: a foreign consultant is engaged to assess a Chinese supplier's capacity for a battery materials buyer. The scope originally includes interviewing former employees of a state-owned mining company about production and export plans. On review, the buyer narrows the scope to public filings, site visits arranged with the supplier, customs data from lawful commercial databases and interviews with the supplier's own management. The questions that might have required non-public state-owned enterprise information are dropped. The project achieves its commercial purpose with far lower risk. The buyer also documents the revised scope and instructs the consultant in writing on permitted methods, so that it can show, if ever asked, that it took national security considerations into account from the start.

If the authorities visit an office

Organisations should prepare for the possibility that state security or other officers visit an office, request documents or ask to speak with staff. Reception and office managers should know whom to call, staff should cooperate politely and must not destroy or hide documents or devices, and the organisation should engage licensed PRC counsel immediately. Afterwards, it should record carefully and promptly what happened and consider practical support for affected staff, including whether any of them should leave China or avoid travel there in the near term.

Building an organisational programme

1. Identify activities, teams and projects with national security exposure, including research, due diligence, technology and data functions.
2. Adopt guidelines on information gathering, interviews, use of expert networks and engagement with officials.
3. Classify data and technology, applying Chinese and foreign export control and data rules.
4. Require pre-approval of high-risk projects by legal and compliance.
5. Provide travel guidance and device policies for staff visiting China.
6. Prepare a response protocol for contact by state security or other authorities, including notification of the employer, consulate and licensed PRC counsel.
7. Review the programme as laws and enforcement priorities evolve.

Related issues are covered on our pages on state secrets and audit working papers, important data and data security and export controls and sanctions.

How TRW & Co helps

We help multinational companies, investors, universities, research organisations and individuals manage national security risk in their China activities. We review the scope of due diligence and research projects, design information-gathering and travel protocols, structure research collaborations with data, technology and human genetic resources issues in mind, and prepare response plans for contact by the authorities. We advise on foreign export control, sanctions and research security rules where our lawyers are qualified. Where PRC legal advice, approvals or filings, or representation of individuals before Chinese authorities is required, we work with licensed PRC law firms. Please contact us in confidence.