New Draft Amendments to China Cybersecurity Law

Introduction

On March 28, 2025, the Cyberspace Administration of China (CAC) issued new draft amendments to the Cybersecurity Law (CSL Draft Amendments) for public comment until 27 April 2025. Originally enacted on 1 June 2017, the Cybersecurity Law (CSL) is now being revised to better align with related legislation—namely, the Data Security Law (DSL), Personal Information Protection Law (PIPL), and the Administrative Penalty Law (APL).

This article explores the key amendments, enforcement shifts, and practical compliance strategies businesses need to navigate China’s rapidly evolving cybersecurity landscape.

Legal Responsibilities for Network Operation Security

The CSL Draft Amendment strengthens penalties for severe network security breaches, aligning Article 59 of the CSL with the DSL.

Legal Responsibilities for Network Information Security

The CSL Draft Amendments update Articles 68 and 69. They address emerging risks and reflect recent enforcement practices. They also clarify penalties for not reporting or stopping the spread of prohibited information.

Non-Compliant Procurement of Cyber Security Products

The CSL Draft Amendment amends article 65 of the CSL into a new article 67.

The Addition of New Provisions

Legal Responsibilities for Personal Information and Important Data Security

The CSL Draft Amendment aligns the CSL with China’s DSL and PIPL by clarifying that violations involving personal information and important data will be subject to penalties under those more specific frameworks. Specifically, the following actions will now be punished in accordance with relevant laws and administrative regulations:

• Publishing or transmitting prohibited information, including content restricted under Article 12(2) and other laws.
• Violations of personal information protection, such as breaches of Article 22(3) and Articles 41–43, which safeguard individuals’ lawful data rights.
• Cross-border data violations, including unlawfully storing or transferring personal or important data overseas in breach of Article 37.

This shift ensures more consistent and specialized enforcement of data protection obligations across China's broader legal landscape.

Significance of the CSL Proposed Draft Amendments

The amendment is crucial to closing regulatory gaps and ensuring consistency with newer, stricter laws like the DSL and the PIPL. It enhances enforcement by introducing tougher penalties, addressing previous weaknesses in deterrence. As cyber threats grow in scale and complexity, the changes equip regulators with stronger legal tools to manage risks across network security, critical infrastructure, and cybersecurity products. Additionally, the amendment reflects China's strategic shift toward digital sovereignty by tightening controls on foreign technologies in sensitive sectors.

Impact of the CSL Proposed Draft Amendments

The latest amendments to China’s CSL significantly heighten compliance requirements and enforcement risks for businesses, impacting not only CII operators but also general network operators and network product suppliers.

For CII operators, the proposed revision of CSL demands

• stronger supply chain security practices,
• reassessment of their security review processes, particularly in procuring network equipment and services, and
• compliance with China's cross-border data transfer regulations.

General network operators must prioritize stronger mechanisms for managing illegal online content, as the amendments impose higher penalties for failing to prevent or address such violations. Developing robust emergency response plans for content-related incidents is critical, and businesses should enforce more stringent vetting procedures for third-party network product suppliers to meet China’s enhanced cybersecurity standards.

Network product suppliers will face more stringent market access requirements. Under the proposed revised law, companies must secure security certifications or testing approvals before selling products in China, requiring them to implement comprehensive security lifecycle management practices to ensure compliance from design through to deployment and maintenance.