Cybersecurity
China Cybersecurity Law: check network, data, critical-infrastructure, review, app and connected-product duties.
Start with the specific network, system, service, app, product, procurement, or data activity in China. Then identify the legal entity acting as , provider, data processor, platform operator, app sponsor, or purchaser under each controlling instrument.
The Cybersecurity Law applies to constructing, operating, maintaining, and using networks in China. It first took effect on 1 June 2017; amendments adopted on 28 October 2025 took effect on 1 January 2026 and renumbered the operating duties. Critical information infrastructure () status depends on identification and notice by the responsible sector protection department. Important-data status depends on the applicable national, regional, departmental, industry, or sector catalogue or an authority identification. Neither status follows automatically from being a . The review measures, app rules, filing notice, and recommended standards have separate actors and triggers.
Scope the particular China network, system, app, platform, and data activity; do not label the whole company with one role.
Run the notified- procurement, network-platform national-security and foreign-listing, important-data catalogue, app governance, and filing screens independently.
Retain dated role and applicability decisions, Article 23 and 27 operating evidence, Article 24 product-support records, filings, review materials, incidents, remediation, and change triggers.
Define the specific network, system, app, platform, product, procurement, or data activity first. One organisation may be a for one system, a network product or service provider for another, a data processor, a notified operator, a network platform operator, an app sponsor, or an app distribution platform.
Check whether notified procurement or a network platform operator's data processing affects or may affect national security. Separately apply the mandatory pre-listing filing where a network platform operator holds personal information of more than one million users and seeks a foreign listing. Keep these reviews apart from classification, app governance, Ministry of Industry and Information Technology (MIIT) app filing, and outbound-data routes.
Keep the legal trigger, actor, official source, control owner, operating evidence, filing or review result, incident process, and reassessment trigger together. A designation identifies a recommended Chinese national standard, not a statute. Standards mappings and the voluntary China Cybersecurity Label route do not replace binding network, data, app, telecom, radio, or privacy duties.
Separate law and measure effective dates from app-filing implementation phases and recommended-standard implementation dates. A historical effective date is not a new annual deadline.
New to the regime? Start by scoping the activity and regulated role. If those facts are already documented, move directly to review triggers, evidence, deadlines, enforcement, or a focused comparison.
Identify the specific China network, data activity, app, platform, procurement, or connected product before assigning duties. status requires sector recognition and operator notice; network-operator status alone is not enough.
Classify systems and data, then document whether classified protection or cybersecurity review is relevant and what evidence supports the conclusion.
Keep app-provider, app-distribution-platform, MIIT filing, the smart-home standard, and the voluntary cybersecurity label scheme separate while linking shared product and security facts.
Distinguish one-time historical effective dates from filing phases, event-driven deadlines, recurring controls, and actor-specific enforcement exposure.
Use a comparison when one launch crosses legal regimes, or go to the focused FAQ when the immediate trigger is already known.
Next steps
Sorena AI helps map official China Cybersecurity Law requirements to scoped decisions, evidence records, owners, and change-triggered reviews.
Map duties, , data security, cybersecurity review, app filing, MLPS, and security-operation records to official citations, owners, and review checkpoints.
Keep official citations, decisions, approvals, and evidence with the relevant product and compliance records.
Check edge cases before launch, filing, transfer, import, sale, or disposal.