Data Security Law

第十三条 Coordination of development and security

The state coordinates development and security by using data development and industrial advancement to promote data security, while ensuring data security underpins data utilization and industry growth.

第十四条 Big data strategy and digital economy

The state implements a big data strategy and promotes construction of data infrastructure, encouraging data innovation across industries and sectors. Provincial and higher-level governments must incorporate digital economy development into their economic and social development plans and may establish separate digital economy development plans.

第十五条 Intelligent public services

The state supports using data to enhance the intelligence level of public services, which must adequately address the needs of elderly and disabled people and avoid creating obstacles to their daily lives.

第十六条 Technology research and innovation

The state supports research into data development and data security technologies, encourages technology dissemination and commercial innovation in these fields, and fosters product and industry systems for data development and security.

第十七条 Standards system development

The state promotes construction of standards for data development technologies and data security. The state council's standards administration and relevant departments must coordinate the formulation and periodic revision of standards for data technologies, products and security. The state supports participation from enterprises, organizations, educational and research institutions in standard development.

第十八条 Data security services and collaboration

The state promotes development of data security detection, assessment and certification services and supports specialized institutions in providing these activities. The state encourages government departments, industry organizations, enterprises, educational and research institutions to collaborate on data security risk assessment, prevention and response.

第十九条 Data transaction management

The state establishes and improves a management system for data transactions, regulates transaction conduct, and develops the data transaction market.

第二十条 Support for talent development

The state supports educational institutions, research organizations and enterprises in developing data technology expertise and providing related training, with the aim of building a skilled workforce and facilitating professional exchange.

第二十一条 Data classification and protection

The state establishes a tiered protection system categorizing data by its importance to economic development and the potential harm if tampered with, destroyed, leaked or misused. Data affecting national security, economic vitality, public welfare or major public interests are classified as core state data requiring stricter management, and regional and departmental authorities must identify important data in their areas and provide focused protection.

第二十二条 Risk assessment and early warning

The state establishes a centralized mechanism for assessing, reporting and monitoring data security risks, with a national coordination body responsible for gathering, analyzing and warning about such risks.

第二十三条 Emergency response

The state establishes procedures for responding to data security incidents, requiring relevant authorities to activate emergency plans, take protective measures to prevent further harm, remove vulnerabilities and provide timely public warnings.

第二十四条 Security review of data processing

The state conducts national security reviews of data handling activities that affect or could affect national security, with review decisions being final.

第二十五条 Export controls on data

The state applies export controls to data classified as controlled items when it relates to national security, interests or international obligations.

第二十六条 Reciprocal trade measures

If any country or region discriminates against China through prohibitions, restrictions or similar measures in investment, trade or related data and technology matters, China may take equivalent countermeasures as appropriate.

第二十七条 Data security management duties

Data handlers must establish comprehensive security management systems, provide training, and apply technical and other safeguards, with those handling important data required to designate a data security officer and responsible department.

第二十八条 Data processing development principles

Data processing activities and research into new data technologies must benefit economic and social development, enhance public welfare, and comply with public morality and ethics.

第二十九条 Risk monitoring and security incidents

Organizations engaged in data processing must monitor for risks and immediately implement remedial measures when discovering security defects or vulnerabilities. Upon a data security incident, they must take immediate action, notify users as required, and report to relevant authorities.

第三十条 Risk assessment for important data

Handlers of important data must periodically conduct risk assessments of their data processing activities and submit risk assessment reports to relevant authorities. Such reports must include the types and volumes of important data processed, the data processing circumstances, data security risks faced, and corresponding countermeasures.

第三十一条 Data export security management

Export security management for important data collected and generated during operations of critical information infrastructure operators within China is governed by the Cybersecurity Law. Export security management rules for important data collected and generated by other data handlers are to be formulated by the national internet information department together with relevant State Council departments.

第三十二条 Lawful data collection

All organizations and individuals collecting data must use lawful and proper methods and are prohibited from stealing data or acquiring it through other illegal means. When laws or administrative regulations prescribe the purpose or scope for collecting or using data, such collection or use must remain within those prescribed purposes and scopes.

第三十三条 Data trading intermediary services

Institutions providing data trading intermediary services must require data providers to identify the data source, verify the identities of both parties to the transaction, and maintain records of verification and transaction activities.

第三十四条 Administrative permits for services

Where laws or administrative regulations require that providing data processing-related services obtain administrative permits, service providers must obtain such permits in accordance with the law.

第三十五条 Data access by security and law enforcement

When public security and state security agencies need to obtain data for purposes of maintaining national security or investigating crimes, they must follow national procedures, obtain strict approval, and act lawfully; relevant organizations and individuals must cooperate.

第三十六条 Data provision to foreign authorities

China's competent authorities handle requests from foreign judicial or law enforcement agencies for data provision according to relevant laws, international treaties or agreements to which China is party, or on principles of equal reciprocity. Domestic organizations and individuals may not provide data stored within China to foreign judicial or law enforcement agencies without approval from China's competent authorities.

第三十七条 Electronic government development

The state shall actively advance e-government systems and strengthen the scientific soundness, accuracy, and timeliness of government data, thereby enhancing the ability to use data for economic and social development.

第三十八条 Government data collection and use

Government agencies collecting and using data to fulfil legal obligations must do so within the scope of their duties and according to legal and regulatory procedures. They must keep confidential any personal privacy, personal information, trade secrets, or confidential business information obtained during their work, and may not disclose or illegally provide such data to others.

第三十九条 Data security management

Government agencies must establish and improve data security systems according to law and regulation, assume responsibility for data protection, and safeguard government data security.

第四十条 Outsourcing government systems

Government agencies outsourcing the construction or maintenance of e-government systems or the storage and processing of government data must follow strict approval procedures and monitor contractors' compliance with data security obligations. Contractors must fulfil their obligations under law and contract, and must not retain, use, disclose, or provide government data to others without authorisation.

第四十一条 Disclosure of government data

Government agencies shall disclose government data in a timely and accurate manner according to principles of fairness, equality, and public benefit, except where disclosure is prohibited by law.

第四十二条 Government data opening

The state shall develop a directory of government data available for opening and build a unified, standardised, interconnected, secure, and controllable platform for releasing government data to promote its open use.

第四十三条 Scope of application

Organisations authorised by law or regulation with public administrative functions that conduct data processing to fulfil their legal obligations are subject to this chapter's rules.

第四十四条 Administrative action on risk

When competent authorities discover significant security risks in data processing activities during their supervisory duties, they may hold meetings with relevant organisations and individuals and require them to take corrective measures to eliminate risks.

第四十五条 Penalties for non-compliance

Organisations and individuals failing to meet data security obligations under articles 27, 29, or 30 face administrative warnings and fines of 50,000 to 500,000 yuan, with individuals liable to 10,000 to 100,000 yuan. Refusing to comply or causing major data breaches incurs 500,000 to 2,000,000 yuan in fines, possible suspension or business closure, and individual penalties of 50,000 to 200,000 yuan. Violating core data management affecting state sovereignty or security incurs 2,000,000 to 10,000,000 yuan in fines and possible business sanctions; criminal liability applies where applicable.

第四十六条 Penalties for unauthorised cross-border data transfer

Providing important data outside the country in violation of article 31 incurs mandatory correction, warning, and fines of 100,000 to 1 million yuan on the entity and 10,000 to 100,000 yuan on responsible individuals; where serious, fines of 1 to 10 million yuan on the entity and 100,000 to 1 million yuan on individuals, plus possible suspension of operations, business closure or license revocation.

第四十七条 Penalties for data trading intermediaries

Data trading intermediaries that fail to meet article 33 obligations must be corrected and face confiscation of illegal gains plus fines of 1 to 10 times the gains, or 100,000 to 1 million yuan if no gains exist; 10,000 to 100,000 yuan fines apply to responsible individuals, with possible operational suspension or license revocation.

第四十八条 Penalties for data non-cooperation and unauthorised disclosure

Refusing to cooperate with data retrieval per article 35 incurs warning and 50,000 to 500,000 yuan fines on the entity and 10,000 to 100,000 yuan on individuals. Providing data to foreign judicial or enforcement agencies without approval per article 36 incurs warning and 100,000 to 1 million yuan fines on the entity; where serious consequences occur, 1 to 5 million yuan fines plus possible operation suspension or license revocation, with 50,000 to 500,000 yuan fines on responsible individuals.

第四十九条 Penalties for non-compliance by state organs

State organs that fail to fulfil data security protection obligations face disciplinary action against directly responsible supervisors and other personnel.

第五十条 Penalties for negligent officials

Government workers with supervisory responsibilities over data security who are negligent, abuse authority, or show partiality face disciplinary action.

第五十一条 Penalties for data theft and anticompetitive conduct

Stealing data or obtaining it through other illegal means, conducting data processing activities that exclude or restrict competition, or damaging the legitimate interests of individuals or organisations are punished according to applicable laws and regulations.

第五十二条 Civil, administrative and criminal liability

Violations causing harm incur civil liability; violations constituting security breaches result in administrative penalties, and violations constituting crimes face criminal prosecution.

第五十三条 Applicability to national secrets and personal data

Data processing activities involving national secrets must comply with the State Secrets Law; data processing in statistics, archival work, or involving personal information must also comply with applicable laws and regulations.

第五十四条 Regulations on military data security

The Central Military Commission shall formulate separate regulations on military data security based on this law.

第五十五条 Commencement

This law enters into force on 1 September 2021.