China. Data localisation / cross-border. Law
DSLData Security Law of the People's Republic of China (数据安全法)
§1Summary
- Synopsis
Framework law for all data (personal and non-personal) that creates a tiered classification system with 'important data' and 'national core data' at the top. It imposes security management duties, risk assessments and export controls on important data, and bars handing China-stored data to foreign courts or police without approval.
- Key themes
- Unique features
Covers non-personal data and links data governance to national security. Prohibits responding to foreign judicial or law-enforcement data requests without Chinese government approval.
- SaaS relevance
SaaS platforms holding industry datasets in China may hold 'important data', triggering assessments, a security lead and export restrictions.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Report data security incidents to authorities and inform users
- DPO
- Conditional
- Cross-border transfers
- Important data export needs CAC security assessment; foreign judicial/enforcement requests need approval
- Maximum penalty
- Up to RMB 10m for breaches of core data rules or unlawful export with serious consequences; business suspension/licence revocation
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text npc.gov.cn
- English text digichina.stanford.edu
- Authority
- Cyberspace Administration of China (CAC)
§5Where it applies
- Domestic law of
- China
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Responsible-person fines are separate. Sectoral important-data catalogues are still being issued.