Back in March 2024, we published a guide on staying safe while traveling to China for business. The core advice in that piece — burner phones, air-gapped working habits, assume your hardware is compromised — still holds. But the legal and threat landscape has hardened sharply since then, and a 2024 checklist will leave your team exposed in 2026. Here is what has changed, and what your travel-security runbook needs to look like before your people board the plane.
What’s changed in 2026
1. China’s amended Cybersecurity Law and new outbound data rules took effect January 1, 2026
The People’s Republic of China amended its Cybersecurity Law and, in parallel, brought the Measures for the Certification of Outbound Personal Information Transfer into force on January 1, 2026. For US companies, the practical effect is twofold:
- Anything pulled, viewed, or synced inside China that contains personal information about Chinese residents is now in scope for cross-border transfer obligations. That includes a sales rep opening a CRM record on a hotel Wi-Fi, an engineer pulling a customer-support ticket, or a recruiter opening a candidate file in Outlook.
- Compliance is no longer optional documentation — it is a certification regime. Larger transfers can require security assessments, standard contractual clauses, or third-party certification, and penalties for non-compliance now reach into the millions of yuan and personal liability for the responsible executive.
The risk is no longer just “someone might steal our data.” It is that your own employee logging into a normal cloud tool from a Beijing hotel room could trigger a regulatory event for your company.
2. Hong Kong’s expanded Article 43 powers (March 23, 2026)
On March 23, 2026, the Hong Kong SAR government published amendments to the Implementation Rules for Article 43 of the National Security Law. The changes meaningfully expand the powers of law enforcement officers in matters involving suspected national security offenses — including the inspection, copying, and retention of electronic devices carried by travelers.
For US executives who treated Hong Kong as a softer landing point than the mainland, that calculus is gone. A laptop or phone crossing the Hong Kong border is now subject to substantially the same risks as one crossing into Shenzhen.
3. Border device searches are no longer a fringe concern
Globally, customs and border authorities — including in the US, EU, UK, and across Asia — have all expanded their authority to inspect electronic devices. Several jurisdictions can now compel travelers to unlock devices, copy their contents, and retain them for forensic review. This is not unique to China, but China is one of the most aggressive practitioners, and the legal threshold for triggering a search is low.
4. The precedent has gone mainstream
During the November 2025 Beijing summit, the US delegation issued burner phones to essentially everyone in the traveling party — White House staff, Cabinet officials, Secret Service agents, the dozen-plus American tech CEOs in the trade delegation, and the press pool. When the President’s own party is treating standard-issue iPhones as a security liability on Chinese soil, your sales director’s MacBook Pro is not a closer call.
The updated checklist
Before the trip
- Issue clean hardware. A burner phone (an inexpensive Android, factory-fresh, with only the apps needed for the trip) and a clean laptop with no historical data, no synced mail archives, and no saved credentials. Treat both as disposable.
- If sensitive data must travel, carry it on a hardware-encrypted USB (Apricorn, IronKey, or equivalent) — never on the device itself. Keep the device and the key physically separated when crossing borders.
- Lock down Microsoft 365 / Entra ID before departure. Set a Conditional Access policy that geo-blocks sign-ins from China and Hong Kong, then create a narrowly scoped traveling-user exception with stepped-up MFA. Revoke all active refresh tokens before the user departs so old session cookies cannot be silently reused.
- Disable biometrics for the trip. In several jurisdictions, officers can compel a fingerprint or face unlock but cannot compel a passphrase. Use a long, alphanumeric PIN and turn off Touch ID / Face ID before crossing the border.
- Pre-stage cloud access via short-lived links. Instead of letting the user log into your full SharePoint or Drive in-country, share only the specific files needed via expiring links with download disabled and per-document watermarking.
- Brief the traveler on the legal exposure. Make sure they understand they may be asked to unlock the device, that refusing has consequences, and that nothing they say or carry should embarrass the company if it ended up on a Chinese state desk.
In country
- Assume every network is hostile — hotel Wi-Fi, conference Wi-Fi, even your own corporate VPN routed through a Chinese ISP. The Great Firewall is not just a censorship tool; it is also a traffic-inspection layer.
- No personal accounts on the burner device. No personal Gmail, no iCloud, no banking apps. If it is compromised, the blast radius stops at the burner.
- Air-gap when reviewing anything sensitive. If a document truly cannot be read on a clean device, read it offline from an encrypted USB and unmount immediately.
- Avoid Bluetooth and AirDrop. Both have well-documented attack surfaces and are trivial to fingerprint in dense urban environments.
- Do not leave devices in your hotel room. Hotel safes do not protect against state-level adversaries. If you must leave a device, assume it has been imaged in your absence.
After the trip
- Quarantine. The burner devices do not come back onto your corporate network. Period.
- Wipe and destroy. Factory-reset the burner phone, then physically destroy it. For laptops, wipe, reflash firmware, or — for any device that handled sensitive material — dispose of it.
- Rotate every credential the traveler touched. M365, VPN, SaaS, banking, the lot. Force a sign-out of all sessions and audit sign-in logs for anomalies for at least 30 days.
- Mailbox and Teams audit. Review the user’s mailbox rules, OAuth grants, and Teams app installs. Persistent access often hides in benign-looking inbox rules and consented third-party apps, not in malware.
The compliance angle most companies miss
Two years ago, the China travel conversation was almost entirely about protecting your stuff. In 2026, it is equally about not creating a compliance event for your company. If your traveling employee accesses a CRM record containing the personal information of Chinese residents from inside China, you have arguably engaged in a regulated cross-border data activity — even though the data never “moved.” The same logic applies to HR systems, support ticketing, and any SaaS that lists Chinese contacts.
Practical guardrails:
- Identify which of your SaaS systems contain personal information about Chinese residents, and whether they can be data-minimized or scoped down for traveling users.
- Document a written travel-data policy that defines which systems may and may not be accessed from China, and have the traveler acknowledge it in writing before departure.
- If you have a meaningful China-related data footprint, talk to counsel about whether you need a formal cross-border transfer mechanism in place — not after a regulator asks, but before.
The bottom line
The 2024 playbook of “bring a burner and don’t trust the Wi-Fi” is still the floor, not the ceiling. In 2026, a defensible China travel program looks more like a security-and-compliance bundle: clean hardware, locked-down identity, geo-scoped cloud access, a written data policy, and a post-trip quarantine routine. The penalty for doing it wrong is no longer just a stolen laptop. It is a regulatory exposure that follows your company home.
If you’d like Boston Managed IT to build or audit a China travel-security runbook for your team before your next trip, get in touch and we’ll put one together.
