China’s internet regulator moved Saturday toward requiring data-rich tech companies to undergo cybersecurity reviews ahead of any foreign listings, making explicit for the first time a data-security requirement that marred last week’s U.S. initial public offering by Didi Global Inc.

Separately, China’s main antitrust regulator on Saturday blocked Tencent Holding Ltd. ’s bid to combine the country’s two biggest game-streaming platforms, its first public intervention to halt a merger in China’s technology sector.

The moves come at the end of a week that was marked by a flurry of actions by Beijing aimed at reining in the nation’s tech giants. The two moves are the clearest signals yet that authorities are tightening the leash on overseas-listed Chinese companies amid concerns about data security. It also shows that regulators are rethinking the bigger-is-better mentality that allowed homegrown companies like Tencent and Alibaba Group Holding Ltd. to become global players.

The security review revision, released Saturday by the Cyberspace Administration of China for public comment, said companies holding personal data on at least one million users must apply for a cybersecurity review. Previously, companies seeking overseas stock listings weren’t explicitly obligated to conduct such reviews, though they would typically do so if asked by officials.

The Wall Street Journal reported earlier that Didi, the Chinese ride-hailing firm, pushed ahead with its $4.4 billion New York IPO late last month despite being urged by China’s internet regulator to submit itself to a cybersecurity review.

After Chinese ride-hailing giant Didi made its Wall Street debut, Beijing said it plans to tighten rules for homegrown companies looking to raise money overseas. WSJ’s Yoko Kubota takes a Didi ride to explain what the crackdown means for China’s tech titans and investors. Photo illustration: Ang Li The Wall Street Journal Interactive Edition

Meantime, China’s State Administration for Market Regulation on Saturday ordered Tencent—China’s largest tech company by market value—to halt the merger of Huya and DouYu, two U.S.-listed Chinese counterparts of Amazon.com Inc.’s videogame streaming platform Twitch. Tencent is the largest Huya shareholder and is a major shareholder of DouYu; together, the two services account for more than 70% of the country’s game-streaming market by revenue.

The merger, which was unveiled last October, would have created a platform with more than 330 million monthly active users who watch top gamers play on their sites.

In its Saturday statement, the market regulator said combining Huya and DouYu would hurt competition and hinder sustainable development of the online gaming and live-streaming industries.

The regulator described antitrust operations as “the Sword of Damocles” dangling over the heads of China’s tech giants in a separate commentary carried on its official social media account. It said its actions were prompted by a desire to ensure tech companies could move from the stage of “barbaric growth” to one of “orderly development under the rule of law.”

In a statement Saturday, Tencent said it would abide by the regulator’s decision, comply with regulatory requirements, follow the law and fulfill its social responsibilities. Huya and DouYu didn’t respond to requests for comment.

The new cybersecurity review requirement and the merger blocking follow a string of high-profile actions by China’s regulators, who used to keep a low profile.

Late Friday, China’s cyber watchdog ordered mobile app stores to remove 25 apps operated by Didi’s China arm and banned websites and platforms from providing access to Didi-linked services in the country.

Last week, officials banned Didi from adding new users, launched a probe into the company’s data practices and then removed its main app from the country’s mobile app stores.

On Monday, a unit of China’s cybersecurity regulator launched similar data-security reviews into popular mobile apps operated by Full Truck Alliance Co. and Kanzhun Ltd. , two other Chinese tech companies that recently listed in the U.S.

—Raffaele Huang contributed to this article.

Write to Keith Zhai at keith.zhai@wsj.com and Frances Yoon at frances.yoon@wsj.com