On 10 June 2021, the Data Security Law of the People’s Republic of China ("Data Security Law") was passed by the Standing Committee of the National People's Congress, which will come into force on 1 September 2021. The Data Security Law aims at regulating data processing activities, ensuring data security, improving data development, and protecting relevant rights and interests.
The Data Security Law provides definitions of data, data processing and data security from a legal perspective. According to the Law, “data” refers to any record of information by electronic or other forms; “data processing” includes collection, storage, use, processing, transmission, provision, disclosure of data, etc.; “data security” refers to the ability to ensure that data remains in the condition of being effectively protected and legally used, and equips the ability to continuously remain in secure.
The Data Security Law also introduces the data security system, according to which a data categorization and classification protection system shall be established. For data related to national security, lifeline of the national economy, livelihood, vital public interests and other aspects belong to national core data, stricter management system shall be applied. Data processors shall establish and complete a data security management system across the entire workflow, organize and conduct data security training, and adopt corresponding technical measures and other necessary measures to safeguard data security. When dealing with important data, processors shall conduct risk assessments periodically and submit a risk assessment report to relevant authorities.
In case of being found in violation of provisions concerning data processing, relevant individuals and organizations may be imposed a fine up to RMB 500,000; the direct responsible person may be imposed a fine up to RMB 100,000. In case of being found in violation of provisions related to providing important data overseas, a fine up to RMB 1,000,000 may be imposed; the direct responsible person may be imposed a fine up to RMB 100,000.
Source:
http://www.npc.gov.cn/npc/c30834/202106/7c9af12f51334a73b56d7938f99a788a.
shtml (Chinese)