Shutterstock.com

In just a few weeks, U.S. companies that do business in China are going to confront a host of challenges related to the enactment of a fresh batch of cybersecurity rules that could also force open the locks on trade secrets and other sensitive information.

Most U.S. companies that operate in China were already wary of losing their grip on intellectual property assets, said David Katz, a partner at Nelson Mullins Riley & Scarborough in Atlanta who specializes in privacy and data security. Now, in light of the new, far-reaching rules, doing business in China is likely to be “more challenging and potentially perilous,” he said.

The latest regulations are set to take effect Nov. 1 and would give Chinese authorities the power to peruse a company's records and remotely access corporate networks that may endanger Chinese national security, public safety, network security risks or social order. Under the rules, which are part of sweeping new cybersecurity regulations that were enacted earlier this year, any information that is collected during a search is supposed to be “strictly confidential.”

“The information obtained by the public security organs and their staff in fulfilling their duties of internet security supervision and inspection can only be used to maintain the needs of network security and must not be used for other purposes,” the regulations state.

But that language probably won't be enough to convince outside companies that Chinese police agencies will be safeguarding their proprietary information. “It's business beware,” Katz said. He added that the new rules give the government “quite a bit of power,” which could be used punitively as a retaliatory weapon against U.S. tariffs on imported Chinese goods.

“You should understand that there's the possibility that you'll be required to completely submit to the authority of Chinese regulators when it comes to your network infrastructure, your critical infrastructure,” he said. “That's an awful lot of reliance to be placing on a regulator. There are a lot of risks in relying on the regulatory graces of the Chinese government.”

Edward McNicholas and Yuet Ming Tham, both partners at Sidley Austin who focus on privacy and data security, wrote in a March expert opinion article that China's new regulations will apply to any company that can be defined as a “network operator.” The term, they said, casts a wide net and includes “owners and administrators of an information network and network service providers.”

They added that China's rules differ from the European Union's General Data Protection Regulation—primarily because China's rules are built on the “distinct notion of 'cybersovereignty.'”

The concept “refers to the power of the Chinese state to control the data inside of its country and crossing its borders,” McNicholas and Tham wrote. “The 'important data' covered by the law thus includes not only personally identifiable information, but also trade secrets (often overlapping), and other information that the state considers sensitive, such as information on sensitive cultural and political issues.”

So what can a company do to protect its secret data?

The key is to segregate and encrypt data, according to Robert Cattanach, a cybersecurity and compliance specialist at Dorsey & Whitney in Minneapolis, where he's a partner. He anticipated that China's new regulations will give the government a “blank check” to snoop on companies, which means businesses are going to have to be more vigilant. 

“I would isolate those crown jewels so they're not connected to any networks and I'd encrypt as much as I could,” he said. “You need to carefully segregate your data assets. The data that you generate in China about Chinese residents is fair game and you have to keep it there, but how much of your IP data do you need to have in China if you can help it?”

If the authorities in China demand that a company hand over encrypted or otherwise protected data, it will at least open the door for a discussion about whether the information is pertinent to national security, according to Cattanach.

“You try to make it difficult while being nice about it,” he said. “This is a cat-and-mouse game. We're going to see how this rolls out and how aggressive they're going to be.”

Read more: 

Experts: Trade War Will Not Push China to Enforce Intellectual Property Laws

More Tariffs, More Problems: GCs Seek Answers in the Fray