China Cybersecurity Law
Amended China · In force Jun 1, 2017 · no upcoming deadlines
Deadlines
| Date | What happens | When |
|---|---|---|
| Jun 1, 2017 | Cybersecurity Law takes effect9.3 years ago | 9.3 years ago |
| Jan 1, 2026 | 2025 amendments take effect9 months ago | 9 months ago |
Summaries for reference, not legal advice. Check the official text.
What it does
China's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.
- Who it applies to
- All network operators in China (owners, managers and service providers of networks); stricter duties for CII operators. Amended Art. 77 allows sanctions such as asset freezes on foreign organizations whose activities endanger China's cybersecurity.
- Penalties
- Post-amendment (Art. 61): network operators RMB 10,000-50,000 on a first violation, RMB 50,000-500,000 for refusal to correct; CII operators RMB 50,000-100,000 rising to RMB 100,000-1 million. Serious harm (e.g. large data leaks): RMB 500,000-2 million; particularly serious harm: RMB 2-10 million, with responsible individuals fined up to RMB 1 million. Using unreviewed network products in CII: 1-10x the purchase amount.
- Enforced by
- CAC, Ministry of Public Security, MIIT and sector regulators
- Official name
- Cybersecurity Law of the People's Republic of China (as amended by the NPC Standing Committee Decision of 28 October 2025)
- Citation
- Order of the President No. 53 (2016); amended by Decision of the 14th NPC Standing Committee, 18th session, 28 Oct 2025
- Topics
- cybersecurity, data-residency, ai, privacy
Verified 2026-09-22
Research notes
Amendment adopted 2025-10-28 and effective 2026-01-01, per the official Decision text on gov.cn. The original 2016 enactment date comes from the 2016 promulgation, not re-verified here.
Related
Australia Cyber Security Act (ransomware reporting)Questions about China Cybersecurity Law
- What are the China Cybersecurity Law compliance deadlines?
- Jun 1, 2017: Cybersecurity Law takes effect. Jan 1, 2026: 2025 amendments take effect.
- When does China Cybersecurity Law take effect?
- China Cybersecurity Law took effect on Jun 1, 2017.
- Who does China Cybersecurity Law apply to?
- All network operators in China (owners, managers and service providers of networks); stricter duties for CII operators. Amended Art. 77 allows sanctions such as asset freezes on foreign organizations whose activities endanger China's cybersecurity.
- What are the penalties under China Cybersecurity Law?
- Post-amendment (Art. 61): network operators RMB 10,000-50,000 on a first violation, RMB 50,000-500,000 for refusal to correct; CII operators RMB 50,000-100,000 rising to RMB 100,000-1 million. Serious harm (e.g. large data leaks): RMB 500,000-2 million; particularly serious harm: RMB 2-10 million, with responsible individuals fined up to RMB 1 million. Using unreviewed network products in CII: 1-10x the purchase amount.