Regulations on Network Data Security Management

Network products and services must meet the mandatory requirements of the relevant national standards; on discovering a security defect, vulnerability or similar risk, the processor must take remedial action immediately, inform users and report to the competent authority as required, and where national security or the public interest is endangered, must additionally report to the competent authority within 24 hours.

Applies when

Companies shipping model APIs, AI applications or smart-hardware firmware. The threshold for “endangering national security or the public interest” must be written into the policy in advance, or nobody will be willing to make the call during an incident.

Deadline: Within 24 hours to the competent authority where national security or the public interest is endangered.

Evidence to retain

• · Severity taxonomy for vulnerabilities and defects, stating which cases trigger the 24-hour report
• · Template and channel documentation for the 24-hour report
• · Actual filing records and receipts with timestamps
• · Text of the user notification and its publication record

Estimated first-time effort: 5–12 person-days (estimate, not a commitment)

Where personal information or important data is provided to, or entrusted for processing by, another processor, the parties must agree by contract on the purpose, method and scope of processing and the security obligations, and the provider must supervise the recipient’s performance; records of the processing must be kept for at least three years.

Applies when

Companies using third-party annotation vendors (onshore or offshore), cloud providers, vector-database services or third-party model APIs; also B2B2C architectures that pass user data back to enterprise customers.

Deadline: Processing records kept for at least three years.

Evidence to retain

• · Data processing agreement template and the register of executed versions
• · Description of the recipient-oversight mechanism, with questionnaires, audits or spot-check records
• · Register of provisions and entrustments recording recipient, data scope, date and purpose
• · Archive and retrieval evidence demonstrating the three-year retention

Estimated first-time effort: 10–25 person-days (estimate, not a commitment)

A network data processor providing generative AI services must strengthen the security management of training data and training-data processing, and take effective measures to prevent and handle network data security risks. In practice this covers the lawfulness of corpus sources, the compliance of collection methods (Art. 18 separately requires an impact assessment for automated tools and prohibits interfering with others’ network services), the scrubbing of personal and sensitive information from corpora, access control over training and inference environments, and classification and grading of the corpus store.

Applies when

Every company that trains or fine-tunes a model and offers it as a service, including model platforms delivered through an API.

Evidence to retain

• · Training-corpus register recording source, licence or authorisation, collection method and cleaning rules
• · Impact assessment for automated collection tools and a note on robots-policy compliance
• · Detection and removal plan for personal and sensitive information in corpora, with sampling results
• · Access-control matrix and audit logs for training and inference environments

Estimated first-time effort: 15–40 person-days (estimate, not a commitment)

An offshore network data processor handling the personal information of natural persons in China that establishes a dedicated PRC entity or appoints a PRC representative under PIPL Art. 53 must report the entity’s name or the representative’s name and contact details to the municipal cyberspace authority where it is located.

Applies when

Structures that operate through an offshore entity (Singapore, Hong Kong, Cayman and the like) while still serving users in mainland China; companies frequently miss this after a red-chip or VIE restructuring.

Evidence to retain

• · Incorporation documents for the PRC entity or the letter of appointment for the PRC representative
• · Filing materials submitted to the municipal cyberspace authority and the receipt
• · Terms of reference and scope of authority for the PRC representative
• · Updated filings after any change of entity or contact details

Estimated first-time effort: 5–15 person-days (estimate, not a commitment)

A processor handling more than 10 million individuals’ personal information must also comply with Arts. 30 and 32, which apply to important-data processors: designate a network data security officer and a network data security management body, with the officer drawn from management and empowered to report directly to the authority; the management body owns the policies and incident plans, periodic risk monitoring, assessment, drills and training, and the complaints channel; and where a merger, division, dissolution or bankruptcy may affect data security, the disposal plan and the recipient’s details must be reported to a provincial-level or higher authority.

Applies when

Consumer AI applications and platforms above ten million users. Note the count is of individuals whose personal information is processed, which includes historical and unregistered users.

Evidence to retain

• · Methodology note and quarterly counts for individuals whose data is processed
• · Appointment letter for the network data security officer showing management-level status, and the direct-reporting channel
• · Terms of reference for the network data security management body and minutes of its regular meetings
• · Records of risk monitoring, assessments, drills and training
• · Reporting materials and receipts for major corporate changes, where applicable

Estimated first-time effort: 15–35 person-days (estimate, not a commitment)

An outbound transfer of personal information must satisfy one of the eight bases in Art. 35: passing the outbound data security assessment; certification by an accredited body; compliance with the standard-contract rules; genuine necessity to conclude or perform a contract to which the individual is a party; genuine necessity for cross-border HR management under lawfully adopted labour rules and a collective contract; genuine necessity to perform a statutory duty or obligation; genuine necessity in an emergency to protect a natural person’s life, health or property; and any other condition set by law, administrative regulation or the CAC. Important data is governed instead by Art. 37: where it genuinely needs to go abroad, it must pass the outbound data security assessment.

Applies when

Any movement of personal information collected in China to a destination abroad, including calling an offshore model API, using offshore SaaS and support systems, reporting employee and customer data to an offshore parent, and cross-border remote operations access.

Evidence to retain

• · Inventory of outbound transfer scenarios, each tagged with the Art. 35 limb relied on
• · Completion evidence for the route chosen (assessment approval, certification certificate or standard-contract filing receipt), or the documented basis for an exemption
• · Security assessment application and approval for any important data going abroad
• · Reconciliation records showing the actual transfer stays within the assessed scope (Art. 38)

Estimated first-time effort: 10–30 person-days (estimate, not a commitment)

Where notice is given through a processing rule, that rule must be displayed centrally, be easy to access, sit in a prominent position, and be specific and plain. For qualifying portability requests, the processor must provide a route for another processor named by the individual to access and obtain the data. Where automated collection unavoidably captures unnecessary personal information or data for which consent was not lawfully obtained, and where a user closes an account, the data must be deleted or anonymised; where a statutory retention period has not expired or deletion is technically infeasible, all processing other than storage and necessary security measures must stop.

Applies when

All network products serving individual users; especially critical for AI companies that passively collect data through crawlers, SDKs, event tracking or vehicle and robot sensors.

Evidence to retain

• · Screenshots of the processing-rules page evidencing centralised, prominent and accessible display
• · Intake workflow and interface documentation for portability requests
• · Technical approach and execution records for identifying and deleting or anonymising unnecessary personal information
• · Verification report on data erasure following account closure

Estimated first-time effort: 8–20 person-days (estimate, not a commitment)