What is China’s Cybersecurity Law

Who Needs to comply?

Under Article 2, the law applies to networks established, operated, maintained and used within the territory of the People’s Republic of China as well as to the supervision and management practices concerning network security. This includes public and private entities. Under the law, it is not stated that there is any extraterritorial scope, although, in an associated regulation, Measures for Security Assessment of Cross-border Transfer of Personal Data, overseas entities which collect personal data within China's territory must appoint a legal representative or organization that fulfills the responsibilities and obligations of network operators defined in the law.

It is still unclear on how this clause will be enforced, given the ambiguity in the new Cybersecurity law of China. But it is similar to how the GDPR applies extraterritorially.

Cybersecurity requirements

The Cybersecurity Law imposes several important cybersecurity obligations on network operators, with some of the major ones being:

• The protection of personal information, specifically protecting it from disclosure, tampering, destruction and loss.
• Undertaking effective administrative and rational technological measures to safeguard the personal information.
• Carrying out continuous security maintenance and repairing any security flaws as quickly as possible.
• Formulating emergency response plans for cybersecurity incidents, following such plans if an incident occurs, and taking immediate remedial measures.
• Following state-sanctioned multi-level protection systems [MLPS].
• Critical information infrastructure operators, as defined by the State Council, shall evaluate their cybersecurity measures once every year and shall endeavor to take greater protections and safeguards.