Use these answers to decide who is a network operator, what MLPS evidence should contain, when important-data and cybersecurity-review rules apply, and how app and smart-home requirements fit together.
The Cybersecurity Law was amended in 2025 and the amended law took effect on 1 January 2026. The Data Security Law, app rules, review measures, and technical standards are separate instruments.
Start with the China activity, system, , data, product, and transaction. These FAQs separate the Cybersecurity Law's baseline duties from evidence, important-data rules, , app filing and governance, and product standards.
Browse sub-FAQs
Choose the question set you need
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
Most China Cybersecurity Law questions start with scope
The Cybersecurity Law applies to building, operating, maintaining, and using networks in China. A is a network owner or administrator or a network service provider. Apply those definitions to each system and entity rather than labeling an entire corporate group.
Network operators have baseline classified-protection duties. Additional routes depend on separate facts: status and procurement, or , personal-information processing and export, operation of an app or distribution platform, radio functions, telecom network access, and sector rules.
The Cybersecurity Law was amended in 2025 and the amended law took effect on 1 January 2026. The amendment changed legal-liability provisions and added artificial-intelligence governance language. Use the amended law for current penalty or enforcement conclusions, while the linked full text supplies the core scope and duty provisions discussed in these FAQs.
Define the China network, system, app, platform, connected product, data flow, procurement, or listing transaction and the entity performing each role.
Map Article 23 controls, including responsible personnel, technical protection, monitoring, at least six months of network logs, data classification and backup, and the separate Article 27 incident plan.
Screen against current sector or regional catalogues, authority notices, and public identifications; keep personal information and as separate categories.
For procurement or network-platform processing, apply the Measures' national-security test and the distinct one-million-user foreign-listing trigger.
For apps, separate for the , app-provider duties under the 2022 provisions, a distribution platform's provincial cyberspace filing, and personal-information minimization.
For smart-home products, treat GB/T 41387-2022 as a recommended security standard and run telecom, radio, app, privacy, network-operation, and routes separately.
For each question, record the facts, actor, controlling source and version, conclusion, evidence owner, unresolved issue, approval or filing where applicable, and change triggers. A group-wide policy or product label cannot replace a system- or transaction-specific decision.
Keep related regimes distinct. Personal-information rights and export mechanisms belong in the privacy analysis. Telecom network access, radio approval, and mobile-terminal software rules need their own product analysis. Cross-link shared evidence without merging the legal conclusions.
Network-operator and other actor-role analysis for each system or service.
grading record and baseline security-control map.
Important-data screening, governance, assessment, and export decision.
Incident-response, vulnerability-remediation, backup, and log-retention evidence.
Cybersecurity-review intake decision and filing record where triggered.
, app-provider controls under the 2022 provisions, and distribution-platform filing and governance evidence.
Smart-home standard applicability and separate telecom, radio, privacy, app, and network-operation decisions.
Use the answer that matches the actor and activity. If the facts span several roles, keep a separate conclusion and evidence record for each instrument.
Which Cybersecurity Law text and article numbers apply now?
Use the Cybersecurity Law text amended on 28 October 2025 and effective from 1 January 2026. The amendment inserted new provisions and renumbered the operating rules. The current baseline classified-protection duties are in Article 23, network product and service duties in Article 24, network-operator incident duties in Article 27, duties in Articles 33-40, and network and network-operator definitions in Article 78. Older copies that cite Articles 21, 22, 25, 31-39, or 76 for those subjects use the pre-2026 numbering.
Is every a operator?
No. A is the owner or administrator of a network or a network service provider and carries the Article 23 and 27 baseline duties. Critical information infrastructure is a narrower category. The responsible sector protection department applies recognition rules to the specific facility or system, identifies it, and notifies the operator. Sector presence, company size, data volume, or a high level does not replace that notice.
What should an evidence file show?
An evidence file should identify the network, operator, system boundary, business functions, users, hosting, data, interfaces, dependencies, classification method and level, decision status, applicable standard edition and clauses, implemented controls, tests, findings, exceptions, remediation, and retest results. Under the general management measures, level 2 or higher systems have a 30-day filing rule, level 3 systems have at-least-annual assessment and self-inspection cycles, and level 4 systems have at-least-six-month cycles; level 5 follows special security needs. Sector routes can differ. GB/T 22239-2019 is a recommended national baseline standard, not a standalone law or universal certificate.
Does a large data set automatically become ?
No. is identified under the Data Security Law through the applicable national, regional, departmental, industry, or sector catalogue or an authority identification, with attention to the harm that misuse or compromise could cause. Data volume alone is not the classification test. If the data is important data, document the responsible person and management body, periodic risk assessment and report, incident process, and separate export-route decision.
When is a filing required?
A operator must first assess a procurement of network products or services before use and file when the procurement affects or may affect national security. The measures also cover a 's data-processing activity that affects or may affect national security. Separately, a network platform operator holding personal information of more than one million users must file before seeking a foreign listing. The measures use the phrase foreign listing, so check the current official interpretation for the specific destination and transaction. These triggers do not make every procurement, platform, overseas listing, or data export a filing.
Are and app-platform filing the same?
No. An providing an app-based internet information service in China completes through an access provider or distribution platform before a new covered app begins service. An separately files with its provincial cyberspace authority within 30 days after the platform goes online and maintains provider verification, listing and update review, monitoring, complaints, suspension, takedown, and reporting controls. One organisation may need both records if it holds both roles.
Does GB/T 41387-2022 require every smart-home product to be certified?
No. The official standards record identifies GB/T 41387-2022 as a current recommended national standard implemented on 1 November 2022. That record does not create automatic certification or product approval for every smart-home product. Obtain the complete applicable standard before making a clause-level claim, and assess telecom, radio, app, privacy, network-operation, and any voluntary China Cybersecurity Label route separately.
Articles 14-18 support the general level 2-and-above filing period, level 3-5 assessment and self-inspection cycles, filing materials, and inspection rules summarized in the MLPS answer.