Data Security Law

Grade every data category against the national classification-and-grading regime and the specific important-data catalogues published by your sector and regional authorities, and determine whether any of it is important data or national core data. Data that has not been notified or publicly designated as important data by the relevant authority need not be declared as such in an outbound security assessment, but the identification exercise itself must leave a written conclusion available for inspection.

Applies when

Every business processing data in the PRC; where the sector catalogue is not yet published, complete the internal grading anyway and record the basis for the conclusion.

Evidence to retain

• · Data asset inventory and grading register covering data items, sources, grades and owners
• · Written important-data determination, citing the sector catalogue relied on or recording that no designation was received
• · The grading policy document and minutes of the review meeting
• · Change log for grade reclassifications

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

Build whole-lifecycle data security management systems as required by law, run data-security training, and adopt technical and other necessary measures to protect the data. Where processing runs over the internet or other information networks, these duties sit on top of the multi-level protection scheme (MLPS). Important-data processors must in addition designate a data security officer and a data security management body.

Applies when

All data processors; for model vendors this extends to training-corpus repositories, annotation platforms, vector stores and inference logs, which are frequently overlooked.

Evidence to retain

• · Data security policy set covering collection, storage, use, processing, transmission, provision, disclosure and deletion
• · MLPS grading filing certificate and assessment report
• · Attendance sheets and test records for data security training
• · Appointment letter for the data security officer and terms of reference for the management body, where important data is processed

Estimated first-time effort: 20–45 person-days (estimate, not a commitment)

Important-data processors must run periodic risk assessments of their processing activities and file the report with the competent authority. The report must cover the categories and volumes of important data handled, the processing activities, the data security risks faced and the countermeasures taken. Art. 33 of the Network Data Security Management Regulations specifies this as an annual exercise filed with a provincial-level or higher authority. From 20 Aug 2026 the Network Data Security Risk Assessment Measures (Order No. 24) make the process concrete: Art. 5 restates the annual cadence for important-data processors and encourages ordinary-data processors to assess at least every three years; Art. 7 allows the assessment to be done in-house or by a third-party assessor; Art. 15 requires the report to be kept for at least three years; Art. 16 requires it to be filed within 20 working days of completing the annual assessment, with the provincial or national cyberspace authority where no competent authority is identified; and Art. 18(4) requires a remediation report within 15 working days where the assessment was mandated through an accredited assessor.

Applies when

Businesses designated as important-data processors — typically holders of autonomous-driving road-test data, industrial point clouds and process data, and surveying or geographic information data.

Deadline: Annually (Art. 33 of the Network Data Security Management Regulations; Art. 5 of the Risk Assessment Measures). From 20 Aug 2026 the report is due within 20 working days of completing the annual assessment (Art. 16 of those Measures); where the assessment was mandated through an accredited assessor, a remediation report is due within 15 working days of completing the fixes (Art. 18(4)); and the report must be kept for at least three years (Art. 15).

Evidence to retain

• · Annual important-data risk assessment report covering categories, volumes, risks and countermeasures, archived for at least three years
• · Filing receipt or submission record from the competent authority, with a timeline comparing the assessment completion date and the filing date to evidence the 20-working-day window
• · Risk treatment log with closure evidence
• · Records of the transaction-level risk assessments run before providing, entrusting or jointly processing important data

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

No organisation or individual in China may supply data stored in the PRC to a foreign judicial or law-enforcement body without approval from the competent PRC authority. Businesses need a standing intake-freeze-assess-escalate process for foreign authority requests so that legal or business staff do not hand data over directly under discovery or regulatory pressure.

Applies when

Chinese companies facing offshore litigation, regulatory investigations, listing audits or parent-company compliance reviews, and vendors whose offshore customer contracts contain extraterritorial disclosure clauses.

Evidence to retain

• · Documented handling procedure for foreign authority requests, including freeze and escalation paths
• · Intake register recording date, requesting body, data scope and disposition
• · Approval application filed with the PRC authority and the decision received
• · Negotiation records or reservations logged against extraterritorial disclosure clauses in offshore customer contracts

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Data that constitutes a controlled item and relates to safeguarding national security and interests or performing international obligations is subject to export control. Businesses should fold the question “is this data a controlled item?” into their export-control classification workflow and connect it to the licensing and end-user screening steps under the Export Control Law and the Dual-Use Items Regulations, rather than treating it purely as a personal-information transfer.

Applies when

Businesses sending technical materials, model weights, training datasets, surveying and remote-sensing data or industrial process parameters abroad; Art. 2 of the Export Control Law expressly includes “technical data relating to items” within controlled items.

Evidence to retain

• · Export-control classification worksheet giving a per-dataset conclusion on controlled-item status and the reasoning
• · Note describing how this ties into the internal export-control compliance programme
• · Approval records for transfers involving controlled data
• · Correspondence with MOFCOM and any reply received, where a classification enquiry was raised

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)