China. Comprehensive data protection. Administrative regulation
NDSMRRegulations on Network Data Security Management (网络数据安全管理条例) (State Council Decree No. 790)
In force
§1Summary
- Synopsis
State Council regulation that operationalises the CSL, DSL and PIPL for 'network data'. It details notice and consent, individual-rights handling, important-data identification and risk assessment, platform duties and cross-border routes.
- Key themes
- Unique features
Extends extraterritorial reach to offshore processing of important data; handlers processing PI of over 10 million people need a dedicated security lead and body.
- SaaS relevance
Sets the day-to-day compliance mechanics (rights requests, sharing contracts, logs) for SaaS processing Chinese users' data, including offshore providers.
§2Obligations
- Extraterritorial
- Yes
- Breach notification
- Activate emergency plan; notify affected parties and authorities promptly
- DPO
- Conditional
- Cross-border transfers
- Security assessment / standard contract / certification or listed necessity exceptions
- Maximum penalty
- Up to RMB 10m under referenced laws; RMB 100k–1m for certain violations, individuals RMB 10k–100k
§3Dates
- Key dates
- Adopted
- In force
- Published 2024-09-30
§4Text and authority
- Text
- Authoritative text gov.cn
- English text chinalawtranslate.com
- Authority
- Cyberspace Administration of China (CAC)
§5Where it applies
- Domestic law of
- China
§6Sources and verification
- Sources consulted
- Verification
High confidence.
text_url and text_url_en are standard gov.cn / China Law Translate locations; exact path not opened.