Data Security Law of the People's Republic of China

Introduction

The Data Security Law of the People’s Republic of China, effective September 2021, establishes a comprehensive legal framework for data security and data governance. The Law applies to data processing activities within China and certain extraterritorial activities.

Data Classification

The Law requires data classification and graded protection based on the importance of data to national security and public interests. Important data is subject to enhanced protection and restrictions on cross-border transfer.

Cross-Border Data Transfers

Operators of critical information infrastructure and entities processing important data must undergo security assessments before transferring data abroad. The Law provides for retaliatory measures against countries that restrict data flows.

Enforcement

The Law imposes significant penalties for violations, including fines up to 50 million yuan (approximately $7 million) and suspension of operations. Individuals responsible may face personal fines and criminal liability.