China’s new data security regime gives President Xi Jinping the power to shut down or fine tech companies as part of his drive to wrest control of vast reams of data held by tech giants like Alibaba Group Holding Ltd. and Tencent Holdings Ltd.

Firms found mishandling "core state data” can be forced to cease operations, have their operating licenses revoked or fined up to 10 million yuan ($1.6 million) under a law passed Thursday by the Asian nation’s top legislative body.

Companies that leak sensitive data abroad can be hit with similar fines and punishments, and those providing data to overseas law enforcement bodies without permission can face financial penalties up to 5 million yuan and business suspensions, according to the law published on the website of the National People’s Congress.