China Cybersecurity Law (CSL)

Why does it matter?

The CSL makes network security a legal duty with named obligations and fines. After the 2025 amendment, the penalty regime is substantially stronger, so organizations that built their programs on the 2017 text need to recheck exposure, particularly operators designated as critical information infrastructure.

Key benefits include:

• Duties for every network operator

Article 21 requires a responsible cybersecurity person, technical defenses, monitoring and logs kept for at least six months, data classification, backups and encryption under the multi-level protection system.

• Real-name and product duties

Article 24 requires real identity information for network access, domain registration, phone access and messaging or publishing services, and Article 22 sets duties for network products and services.

• Special regime for CII

Operators of critical information infrastructure carry added duties for a security management body, background checks, training, disaster recovery, drills, security review of purchases and data localization (Articles 34 to 38 of the 2017 text).

• Personal information rules

Articles 40 to 45 of the 2017 text require lawful, proper and necessary collection, consent, security, breach notification and the right to correction or deletion.

• Higher fines since 2026

The amendment raised the ceiling for CII operators to RMB 10 million and sets fines of RMB 2 million to 10 million where a violation causes CII to lose its main functions.

How does it work?

The 2017 text has seven chapters: general provisions, support and promotion of cybersecurity, network operations security (ordinary provisions, and a section on operations security for critical information infrastructure), network information security, monitoring, early warning and emergency response, legal responsibility, and supplementary provisions. The amendment adds provisions and renumbers the articles, so the article numbers cited here are those of the 2017 text.

Network operators are network owners, managers and network service providers (Article 76). They must follow laws and mandatory national standards, take technical measures to keep networks secure and stable, and respond to incidents (Article 10). Operators must prepare emergency response plans, activate them when an incident occurs and report to the competent departments (Article 25), and must provide technical support to public security and national security organs under the law (Article 28).

The amendment, adopted on October 28, 2025 by the 18th session of the 14th NPC Standing Committee, strengthens legal liability, adds a provision on artificial intelligence safety and development, raises penalties, aligns personal information liability with the Civil Code and the Personal Information Protection Law, and adds rules on large-scale data leaks and on platform duties for illegal information.

Key Elements

• Multi-level protection (Article 21)

Operators implement the state's multi-level protection system: internal security rules and operating procedures, a named responsible person, technical measures against viruses, attacks and intrusion, monitoring and logging with logs kept at least six months, and data classification, backups of important data and encryption.

• Products, services and critical equipment (Articles 22 and 23)

Products and services must meet mandatory national standards and carry no malicious programs, flaws must be fixed and reported, and security maintenance cannot end early. Critical network equipment and specialized cybersecurity products need security certification or inspection before sale.

• Real identity and emergency response (Articles 24 and 25)

Operators providing network access, domain registration, phone access or information publishing and instant messaging must verify real identity information and may not serve users who refuse. They also prepare emergency response plans and report incidents to competent departments.

• Critical information infrastructure (Articles 31 to 39)

CII covers key sectors such as communications, energy, transport, water, finance, public services and e-government, with scope set by the State Council. Operators set up a security management body, run background checks, train staff, keep disaster recovery backups, rehearse incident plans, sign confidentiality agreements with suppliers and test at least once a year (Articles 34, 36 and 38).

• Data localization and transfers (Article 37)

CII operators store personal information and important data collected in mainland China domestically. Transfers abroad that are truly necessary for business require a security assessment under the measures set by authorities, unless other laws provide otherwise. This duty applies to CII operators, not to every organization.

• Personal information and penalties (Articles 40 to 45 and 59 to 66)

Operators keep user information confidential, collect it lawfully with consent and notify users and authorities after a breach. Under the 2017 text, basic failures drew fines of RMB 10,000 to 100,000 and, for CII operators, RMB 100,000 to 1 million. The 2025 amendment lifts the ceiling for CII operators to RMB 10 million.

What does it cover?

The CSL applies to the building, operation, maintenance and use of networks within mainland China and to cybersecurity supervision there (Article 2), so it reaches any network operator in China, including foreign-invested companies. Its stricter provisions apply to operators of critical information infrastructure in sectors such as communications, energy, transport, finance and public services.

What are its objectives?

The CSL aims to ensure cybersecurity and protect cyberspace sovereignty, national security and the public interest (Article 1).

Protect cyberspace sovereignty, national security and social and public interests.

Protect the lawful rights of citizens and organizations in cyberspace.

Impose operational security duties on network operators under a multi-level protection system.

Give critical information infrastructure special protection, including security review and localization.

Regulate collection and use of personal information by network operators.

Set clear legal responsibility and penalties for violations.

Framework in Context

The CSL is one of China's three main data and cyber laws, beside the Data Security Law and the Personal Information Protection Law, and the 2025 amendment moves some liability for data and personal information violations to those laws. Related measures cover the multi-level protection scheme, critical information infrastructure protection and cybersecurity incident reporting.

Common Framework Mappings

Organizations commonly map CSL requirements to international security and privacy standards to harmonize controls, simplify compliance, and meet cross-border data protection and operational resilience obligations.

Mapped frameworks include:

APEC Privacy Framework

CIS Critical Security Controls

EU General Data Protection Regulation (GDPR)

ISO/IEC 27001

ISO/IEC 27701

Multi-Level Protection Scheme (MLPS)

NIST Cybersecurity Framework

Personal Information Protection Law (PIPL)