China cyber and data regime

Nothing changed in the last 90 days. Sign in to read further back.

1. 2026-01-01 Amended Cybersecurity Law takes effect, with higher fines and new AI provisions
2. 2025-11-01 CAC measures on reporting national cybersecurity incidents take effect
3. 2025-10-28 NPC Standing Committee adopts the decision amending the Cybersecurity Law
4. 2025-05-01 CAC measures on personal information protection compliance audits take effect; handlers of over 10 million people's data must audit at least every two years

1. 2026-01-01
   Cybersecurity Law (as amended on 28 October 2025) AmendmentCurrent text

   The NPC Standing Committee decision of 28 October 2025 strengthened legal liability, raised fines, added an article on artificial intelligence and widened application to foreign actors; it took effect on 1 January 2026. source

   More

   • Operators whose failures cause especially serious consequences, such as critical infrastructure losing its main functions, face fines of 2 to 10 million yuan (new Article 61).
   • Network operators handling personal information must also comply with the Civil Code and the Personal Information Protection Law (new Article 42, paragraph 2).
   • Selling critical network equipment or dedicated security products without required certification or testing becomes a separately penalised offence (new Article 63).
   • Foreign organisations or individuals endangering China's network security can face asset freezes or other sanctions where the consequences are serious (new Article 77).
2. 2017-06-01
   Cybersecurity Law (2016) Major version

   Adopted on 7 November 2016 and in force from 1 June 2017. source

The regime reaches network operators and data processors in China, critical infrastructure operators with extra duties, and foreign companies processing data on people in China.

Multi-level protection

The state applies a multi-level protection scheme for network security, and network operators must meet its security duties, such as keeping network logs for at least six months (Cybersecurity Law, Article 23). source

Critical infrastructure

Personal information and important data collected and generated in China by critical information infrastructure operators must be stored in China, with a security assessment before any transfer abroad (Cybersecurity Law, Article 39). source

Outside China

The PIPL applies to processing abroad of personal information of individuals in China when the purpose is to provide them products or services or to analyse their behaviour (Article 3). source

Large platforms

The Network Data Security Management Regulations treat platforms with over 50 million registered users or 10 million monthly active users as large network platforms (Article 62). source

Duties are met in-house, with periodic checks: yearly testing for critical infrastructure, privacy audits for large data handlers, and security assessments before some data exports.

Annual testing

Critical information infrastructure operators test and assess their network security and risks at least once a year and report the results (Cybersecurity Law, Article 40). source

Privacy audits

Handlers of personal information of more than 10 million people must carry out a compliance audit at least every two years (Compliance Audit Measures, Article 4). source

Cross-border transfers

Critical infrastructure operators, exporters of important data and large-volume exporters of personal information need a CAC security assessment; smaller volumes use a standard contract or certification. source

Incident reporting

The CAC's incident reporting measures set reporting entities, procedures, time limits and content for network security incidents from 1 November 2025. source

CAC and sector regulators impose fines, suspensions and licence revocations; PIPL fines reach 50 million yuan or 5% of the previous year's turnover.

Who enforces

The CAC and other departments responsible for personal information protection order corrections, issue warnings, confiscate unlawful gains and fine (PIPL, Article 66). source

Recent fines

1. 2023-09-01 ¥50 million

   CNKI (知网), for unlawful collection and handling of personal information in 14 apps, following a cybersecurity review. source

1. Law text 中华人民共和国网络安全法 (Cybersecurity Law, as amended 2025)
2. Law text 全国人民代表大会常务委员会关于修改《中华人民共和国网络安全法》的决定 (2025 amendment decision)
3. Law text 中华人民共和国个人信息保护法 (Personal Information Protection Law)
4. Law text 中华人民共和国数据安全法 (Data Security Law)
5. Law text 网络数据安全管理条例 (Network Data Security Management Regulations, Decree No. 790)

1. China DNSIP 2012

   The 2012 NPC Standing Committee decision on network information protection: twelve short articles on protecting personal electronic information.

2. GDPR

   The EU regulation, enforced by national data protection authorities with fines of up to 4% of worldwide annual turnover.

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to China cyber and data regime (RSS)