Reviewing China’s Data Security and Important Data Regime

By Kenneth Zhou, Ziquan Gao and Yuxin Zhao

Amendments to the Cybersecurity Law

Since its implementation on 1 June 2017, the Cybersecurity Law (CSL) has served as the foundation of China’s cybersecurity regime. On October 28, 2025, the Standing Committee of the 14th National People’s Congress adopted the Decision on Amending the Cybersecurity Law, which took effect on January 1, 2026.

The Amendments reflect the realities of a rapidly changing technological landscape. A new article dedicated to artificial intelligence governance recognizes the importance of foundational research and core algorithmic capabilities, promotes AI-related infrastructure development, and elevates training data to a key regulatory concern. Regulators have already begun implementing supervisory mechanisms for AI technologies, including algorithmic security assessments, filing requirements for generative AI models, and mandatory labelling of AI-generated content.

Broader changes align the CSL more closely with the Data Security Law (DSL) and the Personal Information Protection Law (PIPL), reinforce cybersecurity responsibilities for Critical Information Infrastructure Operators (CIIOs) — including stricter procurement oversight and supply chain security — and significantly raise the penalty ceiling, with maximum fines reaching RMB 10 million for business entities. Perhaps most notably, the revised law expands the extraterritorial reach of the CSL: liability now attaches to any activity that endangers China’s cybersecurity, a lower bar than the previous standard and one that foreign entities should not underestimate.

Outbound Data Transfer

In May 2025, the Cyberspace Administration of China (CAC) published Q&As aimed at helping data handlers navigate cross-border data transfers more efficiently. The guidance offers some practical relief. On the identification and filing of Important Data, the CAC confirmed that where no sector-specific standards or filing rules have been issued and the handler has not been formally notified by competent authorities, a failure to identify or file Important Data will not, on that basis alone, trigger administrative penalties.

On cross-border transfers, the CAC clarified that Important Data collected or generated in China must pass a CAC-organized data export security assessment before being sent overseas. That said, handlers who have not been notified and whose data has not been publicly designated as Important Data are generally not required to apply for a security assessment on that basis — and the transfer will not be treated as an illegal export of Important Data.

Regulations on Network Data Security

The Regulations on the Administration of Network Data Security, which took effect on 1 January 2025, operationalize key obligations under the CSL, DSL, and PIPL. Their reach is broad: they apply to data processing activities within the PRC as well as to certain offshore activities that harm (or may harm) PRC national security, the public interest, or the lawful rights and interests of PRC individuals.

The practical compliance burden is substantial. Handlers must maintain incident response plans, document the purpose, method, and scope of any sharing or entrusted processing of personal information or Important Data through formal contracts (with records retained for at least three years), and conduct mandatory risk self-assessments before sharing Important Data with third parties. Handlers who process the personal information of more than 10 million individuals in China are also drawn into additional compliance obligations similar to those imposed on Important Data handlers — a threshold that a wide range of consumer-facing businesses may quietly exceed.

Notable Developments

Several further developments round out the 2025 picture. In the industrial sector, three new standards establish a full-chain framework for the identification, protection, and risk assessment of Important Data across 20 industries. For M&A transactions, Important Data handlers undergoing mergers or dissolution must now report disposal plans to competent authorities, and data compliance due diligence has become an indispensable part of deal preparation. On cross-border financial data, China’s central bank and several regulators jointly issued guidance cataloguing 108 common financial business scenarios to streamline compliance reviews. On cybersecurity incident reporting, new rules require network operators to classify incidents by severity and report major incidents to the CAC — in some cases within one hour.