Chinese Cyber Law

Mon, 06 Jul 2026 00:00:00 +0000

The Cybersecurity Law 2017

The Cybersecurity Law of the People’s Republic of China, adopted by the Standing Committee of the National People’s Congress on 7 November 2016 and effective from 1 June 2017, constitutes the foundational legal instrument governing cybersecurity in China. The Law establishes a comprehensive regulatory framework addressing network security, data protection, and critical information infrastructure. The Cybersecurity Law imposes a multi-level protection scheme (MLPS) requiring network operators to implement security protections commensurate with the classification level of their networks, ranging from Level 1 (lowest) to Level 5 (highest). Operators must fulfil obligations including the adoption of technical measures to prevent network intrusion, data leakage, and system damage; the formulation of incident response plans; the conduct of security assessments; and the reporting of security incidents to competent authorities. The Law imposes heightened obligations on operators of critical information infrastructure — organisations whose failure or destruction would seriously endanger national security, the national economy, people’s livelihoods, or the public interest, as designated by sectoral authorities. CII operators are required to store within China personal information and important data collected or generated during operations in China, to undergo annual security assessments, to conduct security impact assessments prior to procurement of network products and services that may affect national security, and to obtain government security reviews of such procurements.

cyber law on ExcellentWiki - Legal Encyclopedia

Chinese Cyber Law

The Cybersecurity Law 2017