China's NMPA issues final measures on regulatory data protection

On May 15, 2026, China's National Medical Products Administration ("NMPA") issued the Implementation Measures for Drug Trial Data Protection (the "Measures"), effective immediately, to formalize China's protection regime for eligible undisclosed chemistry, manufacturing and control (CMC) and clinical study data submitted in marketing authorization applications. The Measures define the eligible products, protection periods, application process, publication mechanism, and restrictions on follow-on applications that rely on protected data.

Key Requirements and Practical Impact

The Measures apply to eligible chemical drugs and biological products approved in China, and they protect complete, non-public CMC and clinical study data that the applicant independently obtained and first used in China for a marketing authorization application. The maximum protection period is six years and runs from the date the marketing authorization is approved in China.

Key protection periods include:

• Six years for innovative drugs and imported originator drugs not previously marketed in China, with protection covering all CMC and clinical study data used to establish safety, efficacy, and quality controllability.
• Four years for modified new drugs and imported modified drugs not previously marketed in China, limited to new clinical study data showing clear clinical advantages and excluding bioavailability, bioequivalence, and vaccine immunogenicity data.
• Six years for certain new indications of imported originator drugs first filed globally, where the applicant submits the required full safety, efficacy, and quality-related CMC and clinical study data. Later additional indications for the same drug may receive four years of protection for the relevant CMC and clinical study data that are relating to the subsequent indications.
• Three years for the first approved domestically manufactured and imported generic, with protection limited to necessary clinical study data supporting approval.
• No data protection for follow-on generics, follow-on vaccines, biosimilars, and other biological products that do not fall under any of the previous categories.

During the protection period, NMPA will not approve a later marketing authorization or supplemental application that relies on protected data without the marketing authorization holder's consent. The applicant of a later marketing authorization or supplemental application may still obtain approval if it independently generates and submits its own data, but an application will not be approved if the technical review finds that it in fact relies on protected data. Follow-on applicants may submit applications relying on protected data during the final year before expiry, but CDE may suspend the review clock after technical review and approval may be issued only after the protection period expires.

Filing, Publication and Transitional Deadlines

Applicants seeking data protection must request it when filing the relevant marketing authorization application, and CDE will confirm the scope and duration of protection during technical review. If the data protection is confirmed by the CDE, the NMPA will note the data protection information in the approval documents, and CDE will publish relevant information on the NMPA's website.

Companies with applications accepted before May 15, 2026 pending for review or approval must assess eligibility promptly because the Measures require eligible applicants to submit data protection applications to CDE within 15 days from May 15, 2026. Failure to submit within that window is treated as a waiver of data protection.

Data protection may terminate if (i) the approval is revoked, canceled, or withdrawn, (ii) the marketing authorization holder voluntarily waives protection, or (iii) in other circumstances provided by law or regulation.

What This Means for Your Business

Life sciences companies should integrate data protection analysis into China regulatory strategy at the beginning of each filing, because the default rule requires the request to be made with the marketing authorization application. Originators and innovators should assess whether their China dossiers include qualifying undisclosed data and be ready to monitor the CDE publication platform after approval.