A series of laws implemented in 2017 asserted the party’s power to gain access to private data on Chinese networks, whether in China or associated with Chinese firms such as Huawei overseas.

Now Beijing has quietly enacted a new set of laws — first the Data Security Law in September, followed in November by the Personal Information Protection Law — that go even further by demanding not just access to private data but also effective control over it.

This has a huge impact on foreign firms operating in China. Not only must their Chinese data stay in China and be accessible by the state, but Beijing now demands control over whether they can send it to their own headquarters; to a corporate lab in, say, California; or to a foreign government that has made a law enforcement or regulatory request.

Beijing’s new laws may make it criminal to comply with foreign sanctions against China that involve data — like shutting off banking or cloud services to a Chinese entity linked to human rights atrocities. In these cases, foreign firms can comply with U.S. law, or they can comply with Chinese law, but not both.