What is lawful to collect from Chinese public records?

Four, and they do different work. The counter-espionage law, amended on 26 April 2023 and effective 1 July 2023, added a catch-all to the definition of espionage covering documents, data, materials or items relating to national security and interests. That phrase is not statutorily defined, so commercial, industrial and registry data could in principle be swept in at the discretion of state security organs. The ambiguity is the operative risk; there is no specific prohibition to point at.

The data security law and the personal information protection law, both from 2021, govern what leaves the country. A cross-border transfer triggers a mandatory security assessment once important data is involved, or the personal information of more than a million individuals, or sensitive personal information of more than ten thousand, thresholds that count cumulatively from 1 January each year. Important data has no bright-line definition either; it is set by sector catalogues, so an operator outside China cannot confirm in advance that scraped registry data falls outside it. The personal-information law is also extraterritorial: it reaches processing performed outside China where the purpose is analysing or assessing the behaviour of people in China.

The network data security management regulations, State Council order 790, effective 1 January 2025, regulate scraping directly. Article 18 requires operators of automated collection tools to assess the impact on the target's network services and not to intrude upon or interfere with normal operation. Article 24 imposes an affirmative duty to delete or anonymise personal information that automated collection unavoidably sweeps up, or that was collected without lawful consent.

The fourth is the oldest and the one that actually bit. The measures for the management of foreign-related surveys, a 2004 statistics-bureau order still in force, require a permit for surveys commissioned or funded by overseas entities, cooperative surveys with foreign parties, surveys run by China branches of overseas organisations, or providing survey results to foreign entities. The trigger is active collection from respondents, surveys and interviews, not passive reading of public registries.

The 2023 cases are worth reading precisely, because what was punished was narrower than doing research in China.

• A corporate-investigations firm had its Beijing office raided in March 2023 and five Chinese staff detained without notice. It was fined roughly US$1.5m in August 2023, confiscation of RMB 5.34m in proceeds plus an equivalent penalty, by the Beijing municipal statistics bureau, for conducting 37 unapproved foreign-related statistical investigations between March 2019 and July 2022. The staff were held around two years and released in March 2025. The charge was not data access; it was unpermitted survey and interview fieldwork reported to a foreign principal.
• A management consultancy's Shanghai office was visited by police in April 2023, who questioned staff and took computers and phones. There were no detentions and no reason was ever disclosed.
• An expert-network firm had its Shanghai, Beijing, Suzhou and Shenzhen offices raided simultaneously in May 2023. State security alleged it frequently contacted personnel with access to classified party and government information and paid experts to obtain sensitive data unlawfully. The expert-network model itself was the target, not one errant consultant.

The common thread is people. In all three, the activity at issue was reaching human beings for information, surveying them, interviewing them, paying them, rather than reading what a government had chosen to publish. That distinction is the whole basis for operating at all, and it is also the reason this site's method is built entirely on records that someone was required to file.

Safe: passively reading public registries, court records and announcements, customs tariff schedules, stock-exchange and securities-regulator filings, initial-offering prospectuses, published sell-side research, standards texts, licence and qualification lists, and pollutant-discharge disclosures, from outside China, with no interviews and no paid informants. That covers the overwhelming majority of the forty-one sources the research maps.

Out: putting anyone on the ground in China doing interviews or site visits for this dataset; using expert-network platforms to reach people with non-public information; commissioning or funding any Chinese entity to run surveys without a foreign-related-survey permit; and accessing anything behind a login, paywall or internal system that was not sold to you for that purpose, explicitly including the closed e-cigarette trading platform, which only licensed entities may join.

Three concrete design consequences, all of them visible on the pages. Store the identifier and not the person: the unified social credit code is a company key and carries no personal-information exposure, while a legal representative's phone number is the costliest field in the registry to keep and the least useful. What a unified social credit code is is a glossary entry for exactly that reason.

Second, record the confidence and the record, never a conclusion. A method built on published filings produces dated observations with gaps in them, and the honest way to publish that is a confidence level on every inferred link with the records behind it, which is what the confidence mix reports in aggregate.

Third, rate-limit and say so. Article 18's requirement to assess the impact on the target's service is not onerous for a pipeline that reads a monthly filing table twelve times a year; it is a real constraint on one that hammers a page-by-page registry behind a slider CAPTCHA. The sources that cannot be read politely are the ones to leave out, and the methodology page is where the gaps that creates are listed.

None of the above is legal advice, and none of it is a substitute for counsel on a specific collection plan. It is a summary of what the published statutes say and what the enforcement record shows, with each statute and case cited so a reader can check the primary text rather than take this page's word for it.

Questions people ask

Is it legal to read Chinese company registries from outside China?

Passively reading public registries, court announcements, tariff schedules, exchange filings and licence lists from outside China, with no interviews and no paid informants, sits inside the safe zone described by the statutes and the enforcement record. It is not legal advice, and the boundary moves when collection becomes active rather than passive.

What actually got the due-diligence firms in trouble?

Unpermitted survey and interview fieldwork, and expert-network models that paid people for information. The largest fine was imposed by a statistics bureau for 37 unapproved foreign-related statistical investigations, not by a security agency for data access.

What is the cheapest compliance mitigation?

Store the unified social credit code and drop the phone number. Personal fields are what create cumulative personal-information exposure, and the company identifier does all the joining work the dataset actually needs.

Sources

Every register, statute, agency or document the claims above rest on. Reachability notes are measurements taken from a United States vantage point and describe our access, not the standing of the source.

1. 反间谍法 (Counter-Espionage Law), amended 26 April 2023, effective 1 July 2023Added a catch-all covering data relating to national security and interests, which is not statutorily defined
2. 网络数据安全管理条例 (Network Data Security Management Regulations), State Council order 790Effective 1 January 2025; Article 18 on automated collection impact, Article 24 on deletion duties
3. 涉外调查管理办法 (Measures for the Management of Foreign-Related Surveys), NBS order 7, 2004Still in force; triggers on active collection from respondents, not on reading public registers
4. Cross-border data transfer thresholds under the Data Security Law and PIPLImportant data, 1,000,000 individuals, or sensitive data on 10,000, cumulative from 1 January
5. Reporting on the August 2023 statistics-bureau fine for unapproved foreign-related surveys37 unapproved investigations between March 2019 and July 2022; roughly US$1.5m
6. Reporting on the May 2023 expert-network raidsThe expert-network model was the stated target

Where this guide came from

Written from these passes of the internal source research, so a claim on this page can be traced back to the pass that produced it.

• research/sources-china.md, Legal and risk, The law
• research/sources-china.md, Legal and risk, What actually happened to the due-diligence firms
• research/sources-china.md, Legal and risk, Bottom line for this product