China. Cybersecurity. Law (amendment)
CSL Amendment 2025Decision on Amending the Cybersecurity Law of the People's Republic of China (2025)
In force
§1Summary
- Synopsis
First revision of the Cybersecurity Law, which tightens and tiers penalties by severity of harm and allows fines without a prior refusal to rectify. It aligns PI and data liability with the PIPL and DSL, adds a statutory clause on AI governance and expands action against overseas actors harming Chinese cybersecurity.
- Key themes
- Unique features
First statutory-level AI provision in Chinese law; overseas entities can face fines and asset freezes for conduct harming China's cybersecurity.
- SaaS relevance
Raises fine exposure for SaaS network operators for MLPS and incident-handling failures even on first violation.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Incident-handling failures now separately penalised
- Cross-border transfers
- Refers to PIPL/DSL
- Maximum penalty
- RMB 2m–10m for entity where consequences extremely grave; RMB 200k–1m for responsible individuals
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text cac.gov.cn
- English text cset.georgetown.edu
- Authority
- Cyberspace Administration of China (CAC)
§5Where it applies
- Domestic law of
- China
§6Sources and verification
- Verification
High confidence.
[Link: official Chinese (NPCSC decision reposted on CAC); CSET translation of the amended CSL]