China Cybersecurity Law cybersecurity and data security requirements

The Cybersecurity Law applies to constructing, operating, maintaining, and using networks in China. Amendments adopted in 2025 took effect on 1 January 2026. Article 23 requires network operators to establish internal rules and responsibility, take technical protective measures, monitor and record network operation and security events, retain network logs for at least six months, and apply measures such as data classification, important-data backup, and encryption. Article 27 adds incident planning, prompt risk handling, remediation, and reporting duties.

A network product and service provider has a separate Article 24 route: meet applicable mandatory national-standard requirements, do not install malicious programs, remediate and report security defects and vulnerabilities, notify users as required, and maintain security support for the required or agreed period. This provider role can apply alongside network-operator duties.

The Network Data Security Management Regulations have applied since 1 January 2025 to network data processing in China. A network data processor is the person or organisation that independently decides the purposes and methods of network data processing. The Regulations add operational detail for security management, incident response, transfers and entrusted processing. They define important data and require processors to identify and report it under the applicable rules; the relevant region or department then confirms the category by notice or publication.

An important-data processor must appoint a management-level network-data security responsible person and a management body, assess certain provision, entrusted-processing, or joint-processing arrangements before they occur, and complete an annual risk assessment and report. A network data processor handling personal information of more than 10 million people must also follow the Regulations' responsible-person and management-body requirements and its reporting rule for a merger, division, dissolution, or bankruptcy that may affect data security. Article 28 does not extend the separate annual important-data report duty to that threshold by itself.

CII adds duties only after the relevant infrastructure and operator fall within the CII regime. Articles 36 and 40 require a dedicated security function, personnel measures, disaster-recovery backup, incident exercises, and at least annual security assessment and reporting. Article 37 requires national security review when a CII operator's procurement of network products or services may affect national security. Article 39 applies domestic storage and an outbound-assessment route to personal information and important data collected or generated through CII operations in China; it is not a statement that every data set held anywhere by the corporate group must remain in China. The Cybersecurity Review Measures separately cover network platform operators' data-processing activities that affect or may affect national security and require a filing before a foreign listing where the operator holds personal information of more than one million users.

Assign each duty to the actor named by the controlling instrument. A company-wide security policy does not show whether the CII procurement, platform listing, important-data, app-platform filing, or MIIT filing trigger was assessed.

Keep mandatory legal and filing duties separate from recommended GB/T standards. A standard mapping can support technical evidence. It does not prove compliance with every applicable law or create an automatic certification duty. The voluntary cybersecurity label scheme effective from 1 July 2026 is a separate route governed by product directories and implementation rules.

Keep evidence showing that the China decision was made before the launch, transfer, filing, procurement, disposal, or product change went live.

Keep the record understandable to an external reviewer: decision owner, official source citation, product, app, data-flow, or vendor identifier, approval date, and the trigger for reopening the decision.

Keep Personal Information Protection Law processing rights and personal-information export route selection in the privacy guide; keep telecom network access, radio approval, and mobile terminal app removal rules in the telecom and wireless guide.

When one launch triggers several regimes, link the shared facts such as model number, app package, data flow, supplier, or release date, but keep the legal conclusions separate.