How does important data change China cybersecurity obligations? Direct answer

The Data Security Law classifies data by its importance to economic and social development and by the harm that alteration, destruction, disclosure, illegal acquisition, or illegal use could cause to national security, the public interest, or lawful individual and organizational interests. Regions and departments must identify important-data catalogues for their sectors and protect listed data more closely. Core data is a separate, stricter category. A company's internal 'critical' or 'confidential' label can support screening, but it does not by itself establish either legal category.

For export screening, the 2024 Provisions say a processor does not need to declare data as important data unless a relevant department or region has notified the processor or publicly identified the data as important. This rule addresses the export filing decision; it does not remove the duty to monitor applicable catalogues and official notices.

An important-data processor must identify a data-security responsible person and management body: a named accountable lead and an organizational function responsible for implementing the data-security duties. Under the Network Data Security Management Regulations, the processor must assess its data-processing activities annually and submit a report covering the types and quantities of important data, processing activities, risks, and response measures. General duties to monitor risk, remedy vulnerabilities, handle incidents, notify users where required, and report to the competent authority also apply.

A transfer outside China needs its own route. Under the 2024 Provisions, a CII operator exporting personal information or important data, and a non-CII processor exporting important data, must apply for a data export security assessment through the provincial cyberspace authority, subject to the stated special provisions. Personal-information volume exemptions do not exempt important-data exports.

A successful assessment result is valid for three years from the result date. If the export will continue and no re-application trigger has occurred, the processor may apply for a three-year extension within 60 working days before expiry; the national cyberspace authority decides whether to approve it. Keep the validity period, extension decision, and any change requiring a new application separate from the annual domestic important-data risk assessment.

Preserve the source and date behind the classification. A self-created label alone does not show that the legal category applies.