China DSL

Who it applies to

Data processing activities in China, and activities outside China that harm China's national security or public interests.

Key requirements

• Classify and grade data, with catalogues of important data by region and sector.
• A data security management system, training and technical measures.
• Risk monitoring and regular risk assessments for important data processors.
• Restrictions on providing data stored in China to foreign judicial or law enforcement bodies without approval.
• Export controls for data related to national security and international obligations.

Breach and incident notification

On a data security incident, take immediate measures, notify users in a timely manner and report to the competent authorities.

Penalties

Fines, business suspension and licence revocation, with the heaviest penalties for violations of the core data management system.

Go deeper