China Data Security Law
In force China · In force Sep 1, 2021 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Sets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.
- Who it applies to
- All organizations and individuals carrying out data processing activities in China, plus offshore activities that harm China's national security or public interest. Important-data processors must appoint a data security officer and submit periodic risk assessments.
- Penalties
- Failure to meet security duties: up to RMB 500,000, rising to RMB 500,000-2 million for refusal to correct or serious consequences such as large data leaks (Art. 45). Violating the national core data regime: RMB 2-10 million plus suspension or license revocation. Unlawful export of important data: RMB 100,000-1 million, up to RMB 10 million if serious (Art. 46).
- Enforced by
- Sector regulators, public security and national security authorities; CAC coordinates network data security
- Official name
- Data Security Law of the People's Republic of China
- Citation
- Order of the President of the PRC No. 84
- Topics
- cybersecurity, data-residency, data-access
Verified 2026-09-22
Research notes
Important-data catalogs are issued by region and sector; the Network Data Security Management Regulations (effective 2025-01-01) detail important-data processor duties such as annual risk assessments.
Related
Australia Cyber Security Act (ransomware reporting)
Hong Kong Critical Infrastructure Cyber OrdinanceQuestions about China Data Security Law
- What are the China Data Security Law compliance deadlines?
- Sep 1, 2021: Data Security Law takes effect.
- When does China Data Security Law take effect?
- China Data Security Law took effect on Sep 1, 2021.
- Who does China Data Security Law apply to?
- All organizations and individuals carrying out data processing activities in China, plus offshore activities that harm China's national security or public interest. Important-data processors must appoint a data security officer and submit periodic risk assessments.
- What are the penalties under China Data Security Law?
- Failure to meet security duties: up to RMB 500,000, rising to RMB 500,000-2 million for refusal to correct or serious consequences such as large data leaks (Art. 45). Violating the national core data regime: RMB 2-10 million plus suspension or license revocation. Unlawful export of important data: RMB 100,000-1 million, up to RMB 10 million if serious (Art. 46).