What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal
Ask the operating question
Why it changes the route
Nature/volume of data
What are the current facts, parties, dates and documents for nature/volume of data?
Data type, access and transfer rights can change national-security and sector-review exposure.
Platform function and user base
What are the current facts, parties, dates and documents for platform function and user base?
Platform function and user base can change the applicable legal route, evidence requirement, timing or responsible entity.
Foreign control/governance rights
What are the current facts, parties, dates and documents for foreign control/governance rights?
Equity, veto, board and contractual rights determine who controls the activity or target.
Cross-border data access
What are the current facts, parties, dates and documents for cross-border data access?
Data type, access and transfer rights can change national-security and sector-review exposure.
Sector licence or critical infrastructure status
What are the current facts, parties, dates and documents for sector licence or critical infrastructure status?
The regulated activity and named licence holder determine whether the proposed structure is lawful.
Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Data mapIdentify data categories, scale, location, access and proposed transfers.
02Ownership/governance chartShow direct and ultimate ownership, governance rights and control.
03System architectureShow the systems, infrastructure, access paths and post-closing integration.
04Licence inventoryVerify the regulated entity, authorised scope and current licence status.
05Deal steps and intended post-closing integrationsEstablish the relevant parties, dates, amounts and regulatory facts shown by deal steps and intended post-closing integrations.
Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Is data localisation the same as NSR?

No. Localisation and transfer rules are data-law gates; NSR is security screening of the investment. Both can apply.

Can we diligence freely in a VDR?

Only with a protocol. Use red/amber/green classes from the parent guide.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

Sources last checked:

Foreign Investment Law / implementing regulationNational People’s Congress
2024 Foreign Investment Negative List (effective 1 Nov 2024)zfxxgk.ndrc.gov.cn
Foreign Investment Security Review Measureswww.ndrc.gov.cn
MOFCOM foreign-investment ruleswww.mofcom.gov.cn