CybersecurityChina

China Cybersecurity Law cybersecurity deadlines and compliance calendar

Official cybersecurity, data security, review, app governance, filing, and standards dates.

China cybersecurity deadlines and compliance calendar is a practical China cybersecurity and data-security compliance timeline. It explains what to check, what evidence to keep, and when the decision should be revisited before a China launch, procurement, product change, or operating change.

Back to main artifactReview sources
Author
Sorena AI
Published
Jul 5, 2026
Updated
Jul 5, 2026
Sections
4

Structured answer sets in this page tree.

Primary sources
7

Cited legal and guidance references.

Publication metadata
Sorena AI
Published Jul 5, 2026
Updated Jul 5, 2026
Overview

Official cybersecurity, data security, review, app governance, filing, and standards dates.

Section 1

What this guide helps you decide

China cybersecurity deadlines and compliance calendar explains how network, app, platform, connected-device, security, and data-governance teams should apply China cybersecurity and data-security compliance. It focuses on the decision to make, the evidence to keep, the owner to assign, and the trigger for revisiting the conclusion.

Cybersecurity Law Article 21 sets network-operator security duties; Articles 31 and 35 are central for CII and security review context. Data Security Law Articles 21, 27, and 30 support classification, risk monitoring, and incident handling for data activities.

  • Decide whether the China operation is a network, app, platform, connected product, or CII-adjacent procurement scenario.
  • Map baseline security obligations first: access control, technical measures, monitoring, incident response, and records.
  • Screen whether data could be important data and whether export, sharing, or incident handling needs a separate legal route.
  • For apps, separate MIIT filing and app governance evidence from PIPL notice/consent work.
  • For smart-home or connected products, link product security evidence to telecom, privacy, and radio records without merging the legal conclusions.
Sources for this answer
PRC Cybersecurity Law
Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.
PRC Data Security Law
Use for data classification and graded protection, important-data risk assessment, security management, incident response, outbound important-data context, penalties, and 1 September 2021 effective date.
Cybersecurity Review Measures
Use for cybersecurity review scope, CII procurement filing, platform operator review triggers, review materials, special review, and 15 February 2022 effective date.
Section 2

Calendar and change triggers

Do not treat effective dates as the whole calendar. For China Cybersecurity Law, the operational calendar is built around launch approvals, filings, renewals where applicable, supplier or product changes, incident response, and re-assessment triggers.

The practical point is this: China Cybersecurity Law is not a single document exercise. It is a route decision plus evidence that survives product, supplier, app, data, or disposal changes.

  • Map baseline security obligations first: access control, technical measures, monitoring, incident response, and records.
  • Screen whether data could be important data and whether export, sharing, or incident handling needs a separate legal route.
  • For apps, separate MIIT filing and app governance evidence from PIPL notice/consent work.
  • For smart-home or connected products, link product security evidence to telecom, privacy, and radio records without merging the legal conclusions.
  • Keep network-operator role analysis.
  • Keep baseline security-control map.
Sources for this answer
PRC Cybersecurity Law
Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.
PRC Data Security Law
Use for data classification and graded protection, important-data risk assessment, security management, incident response, outbound important-data context, penalties, and 1 September 2021 effective date.
Cybersecurity Review Measures
Use for cybersecurity review scope, CII procurement filing, platform operator review triggers, review materials, special review, and 15 February 2022 effective date.
Section 3

Evidence to keep before launch or change approval

Keep evidence that proves the China decision was made before the launch, transfer, filing, procurement, disposal, or product change went live.

Keep the record understandable to an external reviewer: decision owner, official source citation, product, app, data-flow, or vendor identifier, approval date, and the trigger for reopening the decision.

  • Keep network-operator role analysis.
  • Keep baseline security-control map.
  • Keep important-data screening note.
  • Keep incident-response and log-retention evidence.
  • Keep cybersecurity review intake decision.
  • Keep MIIT app filing record and platform governance evidence.
  • Keep MLPS/classified protection mapping.
Sources for this answer
PRC Cybersecurity Law
Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.
PRC Data Security Law
Use for data classification and graded protection, important-data risk assessment, security management, incident response, outbound important-data context, penalties, and 1 September 2021 effective date.
Section 4

Boundary with nearby China regimes

Keep PIPL processing rights and personal-information export route selection in the privacy guide; keep telecom network access, radio approval, and mobile terminal app removal rules in the telecom and wireless guide.

When one launch triggers several regimes, link the shared facts such as model number, app package, data flow, supplier, or release date, but keep the legal conclusions separate.

  • Assuming every China technology launch is only a privacy project; network security, app filing, MLPS, and review questions may sit outside PIPL.
  • Calling a supplier review complete before checking cybersecurity review triggers for CII procurement or large platform scenarios.
  • Using one generic security policy as proof of classified protection, important-data, and app-governance compliance.
Sources for this answer
PRC Cybersecurity Law
Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.
PRC Data Security Law
Use for data classification and graded protection, important-data risk assessment, security management, incident response, outbound important-data context, penalties, and 1 September 2021 effective date.
Operationalize the requirement

Build the China network security evidence file

Sorena AI helps turn the China Cybersecurity Law cybersecurity deadlines and compliance calendar decision into owners, controls, and reviewer-ready records.

Research workflow
Map official sources to evidence

Research Copilot connects the official citation, decision, owner, retained evidence, and change history.

Explore next step
Talk to Sorena
Review the China route

Check the China Cybersecurity Law scope decision and unresolved launch questions with Sorena.

Explore next step
Primary sources

References and citations

Cybersecurity Review Measures
cac.gov.cn
Referenced sections
  • Use for cybersecurity review scope, CII procurement filing, platform operator review triggers, review materials, special review, and 15 February 2022 effective date.
PRC Cybersecurity Law
cac.gov.cn
Referenced sections
  • Use for network operator security duties, network product/service security, CII provisions, personal-information security articles, penalties, and 1 June 2017 effective date.
PRC Data Security Law
cac.gov.cn
Referenced sections
  • Use for data classification and graded protection, important-data risk assessment, security management, incident response, outbound important-data context, penalties, and 1 September 2021 effective date.
Related guides

Explore more topics

China cybersecurity and data security requirements
Network operator, data security, cybersecurity review, app governance, MLPS, and smart-home security requirements under China sources.
China cybersecurity compliance checklist
Checklist for network operators, app providers, connected-device teams, review screening, app filing, MLPS evidence, and smart-home security related review.
China Cybersecurity Law FAQ
Answers to practical China Cybersecurity Law questions for scope, official source triggers, evidence records, and related China scope decisions.
China Cybersecurity Law vs EU Cyber Resilience Act
Comparison showing China operator/security duties versus EU product cybersecurity duties under the CRA.
China Cybersecurity Law vs EU NIS2
Comparison of China network/data security duties with EU NIS2 entity cybersecurity duties.
China cybersecurity penalties and enforcement exposure
China cybersecurity, data security, review, and app-governance enforcement exposure.
China cybersecurity review workflow
Intake workflow for procurement, platform, CII, and national-security risk review triggers.
China mobile app filing and app governance
How MIIT app filing and CAC app information service duties affect app providers and distribution workflows.
CII and network operator role triage
How to separate ordinary network operator duties from CII, procurement, and review-risk questions under China cybersecurity sources.
Cybersecurity review vs data export security assessment
Crosswalk for review triggers and data export assessment triggers so teams do not mix procurement/platform review with outbound data transfer review.
Does an app need MIIT filing and CAC app governance review?
Treat app filing and app information service governance as related but separate checks. MIIT filing evidence should not replace CAC app-provider governance, privacy minimization, or cybersecurity duties.
How do smart home security standards fit with China cybersecurity law?
The smart home security standard can support connected appliance security evidence, but it does not replace app privacy, network access, radio, or cybersecurity review analysis. Use it as one control map tied to the cited standard.
How does important data change China cybersecurity obligations?
Important data changes the risk analysis because the Data Security Law establishes data classification and graded protection. The practical record is an important-data screening note, plus export or security-assessment routing where applicable.
Is every company a network operator under China Cybersecurity Law?
Do not start with a generic company label. Start with the network, system, app, platform, data processing, and China operation facts, then map them to network operator, app provider, data processor, CII, or review triggers in the cited sources.
MLPS classified protection baseline evidence
How to use the classified protection baseline standard as evidence mapping without treating the standard itself as a standalone law.
MLPS classified protection evidence map
Evidence map for classified protection baseline controls, source status, owners, and security records.
Mobile app filing vs app personal information rules
Practical overlap guide for MIIT app filing, app information service governance, and app minimum personal-information duties.
Smart home security standard evidence
How connected-device teams can use the smart home security specification and cross-link telecom, privacy, and cybersecurity evidence.
Smart home security vs telecom and wireless launch
Cross-link page for smart connected appliance teams separating cybersecurity standard evidence from radio and network access evidence.
What is MLPS classified protection evidence?
MLPS evidence is a control and classification evidence set, not a standalone substitute for the Cybersecurity Law. Keep system scope, classification rationale, baseline requirement mapping, remediation, and review records.
When does China cybersecurity review apply?
Cybersecurity review analysis is needed when procurement, platform operation, CII, or national security risk facts match the Cybersecurity Review Measures. Keep an intake note with product/service, buyer/operator role, data/system impact, and official source trigger.