China CSL

Who it applies to

Network operators in China (very broadly defined), with stricter duties for critical information infrastructure operators (CIIOs).

Key requirements

• Graded protection under the Multi-Level Protection Scheme (MLPS).
• Security measures, log retention and incident response plans for network operators.
• Real-name registration for certain network services.
• CIIOs store personal information and important data collected in China within China, subject to assessment for transfers.
• Security review for network products and services procured by CIIOs that may affect national security.

Breach and incident notification

Network operators must take remedial measures and report security incidents to the competent authorities; the CAC has issued further rules on reporting timelines.

Penalties

Warnings, fines, suspension of business and revocation of licences; penalty levels were raised by the 2025 amendments.

Go deeper