China. Cybersecurity. Law
CSLCybersecurity Law of the People's Republic of China (网络安全法)
In force
§1Summary
- Synopsis
China's first comprehensive cyber law, requiring network operators to follow the Multi-Level Protection Scheme, protect user information and support real-name registration. Operators of critical information infrastructure must store personal information and important data in China and pass a security assessment before exporting it.
- Key themes
- Unique features
Introduced CII localisation and the MLPS grading regime that underpins later data laws.
- SaaS relevance
Any SaaS operating networks or services in China is a 'network operator' and must meet MLPS, logging and incident-reporting duties.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Remedy and inform users; report to competent authorities
- DPO
- No
- Cross-border transfers
- CII localisation + security assessment
- Maximum penalty
- As amended from 2026: up to RMB 10m for extremely grave consequences
§3Dates
- Key dates
- Adopted
- In force
- First amendment adopted 2025-10-28, in force 2026-01-01 (see cn-csl-amendment-2025)
§4Text and authority
- Text
- Authoritative text cac.gov.cn
- English text digichina.stanford.edu
- Authority
- Cyberspace Administration of China (CAC)
§5Where it applies
- Domestic law of
- China
§6Sources and verification
- Sources consulted
- Verification
High confidence.