China's internet regulator said companies holding data on over a million users must apply for approval before listing overseas, in a move to tighten data security oversight.

The additional procedure was included in a draft of Saturday's updated version of Measures for Cybersecurity Review, which is open for public opinion until July 25.

The new rules are to ensure the supply chain security of crucial information infrastructures and safeguard national security, said the Cyberspace Administration of China (CAC) administration.

The draft said that reviews will consider risks regarding whether critical and vast personal data would be affected, controlled, or maliciously used by foreign governments after an oversea-listing.

It added that inspections will also be made on other national security risks considering core national information infrastructure.

China pledged on Tuesday to speed up revising regulations on data security regarding the company's issuance and listing shares overseas, while also urging overseas-listed companies to take responsibility for safeguarding their cybersecurity.

Read more: 

Investors say China's cybersecurity probe may boost firms' compliance

The move came after the CAC ruled DiDi Global violated laws and regulations regarding the collection and use of personal information in a notice published on July 4, days after the ride-hailing giant raised $4.4 billion in its New York Stock Exchange debut.

The total volume of China's overseas IPOs reached $40 billion by the end of June this year, comparing with $14.6 billion for the whole of 2020, UBS data showed. Among with the $12 billion on U.S. bourses, IPOs worth $28 billion floated in Hong Kong.