The Cyberspace Administration of China released draft rules on Sunday that would require firms to undergo a cyber security review before going public in Hong Kong if it implicates national security, threatening a recent shift as internet companies seek to list in the territory.

The powerful data watchdog launched a probe into Didi Chuxing for suspected data violations two days after its blockbuster $4.4bn IPO on the New York Stock Exchange in June, forcing the once-dominant ride-hailing company to stop registering new users during the investigation.

After the move, the CAC said in July it would tighten rules for companies seeking to sell shares overseas, proposing rules that require companies with personal data of more than 1m users to undergo a security review. However, the guidelines did not clarify whether the requirement applied to Hong Kong listings.