- ClassificationCategoryData Protection & PrivacyDomainData GovernanceFramework FamilyGlobal Privacy Regulations
- Regulatory ContextTypeFrameworkLegal InstrumentLawSectorCross-SectorIndustryCross-Industry
- Region / PublisherRegionAsia-PacificRegion DetailChinaPublisherNational People's Congress (NPC)
- VersioningVersionData Security Law of the People's Republic of China (2021); implementing Decree No. 790 effective January 1, 2025Effective DateSeptember 1, 2021Issue DateJune 10, 2021
- AdoptionAdoption ModelRegulatory ComplianceImplementation ComplexityHigh
- Official ReferenceOpen Link in New TabSource
License included / downloadable: Yes
The Data Security Law is published by the National People's Congress and is included with the platform for reference.
Framework text is licensed by its publisher and is included only where stated above.
- China's Data Security Law requires organizations handling data in mainland China to classify data by importance and run full-process security management.
- Adopted June 10, 2021, it took effect on September 1, 2021.
- Important data and core national data are treated more strictly, and outbound transfers and foreign government requests are controlled.
- Organizations designate a data security lead where they handle important data and file periodic risk assessment reports.
- SmartSuite holds the data classification catalog, important data inventory, risk assessment reports, incident log, and outbound transfer register.
Overview
The Data Security Law of the People's Republic of China (DSL) is China's statute for data security. It requires organizations that handle data in mainland China to classify data by importance, run full-process data security management, treat "important data" and "core national data" more strictly, and control outbound transfers and foreign government requests. The National People's Congress Standing Committee adopted it on June 10, 2021 and it took effect on September 1, 2021 (Article 55).
The law applies to data handling within mainland China and, for overseas handling that harms China's national security, public interest or the lawful rights of citizens and organizations, to liability under the law (Article 2). Sector regulators supervise their own fields, public security and state security organs act within their remits, and the national cyberspace and informatization department coordinates network data security (Article 6).
Organizations implement it by classifying and grading data, keeping a data security management system with training and technical measures built on the multi-level protection system, designating a data security lead where they handle important data, monitoring risks and reporting incidents, and filing periodic risk assessment reports for important data (Articles 21, 27, 29 and 30).
Why does it matter?
The DSL turns data into a regulated asset category. Data security means taking necessary measures to keep data effectively protected and lawfully used and maintaining that capacity (Article 3), and the law links the strictness of protection to how much harm tampering, destruction, leakage or illegal use of the data would cause (Article 21).
Key benefits include:
- Tiered protection by importance
Data is categorized and graded, with regions and departments publishing catalogs of important data and applying stricter management to core national data (Article 21).
- Named accountability
Handlers of important data designate a data security lead and a management body (Article 27).
- Incident duties
Handlers monitor risks, fix flaws immediately and, after an incident, act, notify users and report to regulators (Article 29).
- Periodic risk reports
Important data handlers carry out periodic risk assessments and submit reports on data types and volumes, handling activities, risks and countermeasures (Article 30).
- Serious penalties
Penalties reach RMB 10 million for the gravest unlawful outbound transfers of important data and core national data violations (Articles 44 and 46).
How does it work?
The DSL sets a data security system in several layers. Article 21 requires categorized and graded data protection and a catalog of important data. Article 22 creates a centralized mechanism for data security risk assessment, reporting, information sharing, monitoring and early warning. Chapter IV sets the obligations of data handlers, Chapter V covers government data, and Chapter VI sets legal responsibility.
Handlers must follow laws and regulations, keep a full-process data security management system, provide data security training and take technical and other necessary measures. Where they handle data over networks they build on the multi-level protection system (Article 27). Collection must use lawful and proper methods and use must stay within the lawful purpose and scope (Article 32), and data trading intermediaries must require sources to explain data origins and verify both parties' identities (Article 33).
The Regulations on Network Data Security Management (State Council Decree No. 790), promulgated on September 24, 2024 and effective January 1, 2025, implement the DSL together with the Cybersecurity Law and the Personal Information Protection Law. The 2025 amendment to the Cybersecurity Law moved some liability for data violations into these companion laws.
Key Elements
- Classification, grading and important data (Article 21)
Data is protected by category and grade according to its importance and the harm from tampering, destruction, leakage or illegal use. Regions and departments set catalogs of important data. Data tied to national security, economic lifelines, key livelihoods or major public interests is core national data and gets stricter management.
- Data security management system (Article 27)
Handlers keep a full-process management system, train staff and adopt technical measures, relying on the multi-level protection system for networked handling. Handlers of important data designate a data security lead and a management body.
- Monitoring and incidents (Article 29)
Handlers strengthen risk monitoring and remedy flaws and vulnerabilities immediately. When a data security incident occurs, they take remedial action immediately, notify users according to the rules and report to the competent authorities.
- Risk assessment reports (Article 30)
Handlers of important data conduct risk assessments periodically and send reports to the competent authority covering the types and volume of important data, how it is handled, the risks identified and the countermeasures.
- Cross-border transfers and foreign requests (Articles 31 and 36)
Outbound transfers of important data collected or produced by critical information infrastructure operators follow the Cybersecurity Law, and the cyberspace department sets rules for other handlers. Organizations in China may not provide data stored in mainland China to foreign judicial or law enforcement bodies without approval from the competent Chinese authority.
- Government access and penalties (Articles 35, 44 to 48)
Public security and state security organs may obtain data needed for national security or crime investigations under strict approval, and organizations must cooperate. Failure of the core duties in Articles 27, 29 and 30 draws fines of RMB 50,000 to 500,000, rising to RMB 500,000 to 2 million in serious cases, and unlawful transfers of important data abroad can bring RMB 1 to 10 million.
What does it cover?
The DSL applies to data handling within mainland China, and to overseas data handling that harms China's national security, public interest or the lawful rights of citizens and organizations (Article 2). Data means any record of information in electronic or other form, and data handling covers collection, storage, use, processing, transmission, provision and disclosure (Article 3). The law does not itself require all data to be stored in China; localization duties for critical information infrastructure operators come from the Cybersecurity Law.
What are its objectives?
The DSL aims to regulate data handling, ensure data security and promote lawful use of data.
Establish categorized and graded data protection with catalogs of important data.
Apply stricter management to core national data.
Require data security management systems, training and technical measures.
Require risk monitoring, incident response and reporting to regulators.
Control outbound transfers of important data and foreign government access requests.
Set clear legal responsibility for violations.
Framework in Context
The DSL is one of China's three main data and cyber laws, with the Cybersecurity Law and the Personal Information Protection Law. The Cybersecurity Law governs network operations and critical information infrastructure, the Personal Information Protection Law governs personal information, and the DSL governs data of every kind, whether or not it is personal, with its distinct classification and important data concepts.
Common Framework Mappings
Organizations map DSL to internationally recognized privacy, security, and governance frameworks to harmonize controls, simplify compliance, and support cross-border data processing and auditability.
Mapped frameworks include:
China Personal Information Protection Law (PIPL)
COBIT 2019
EU General Data Protection Regulation (GDPR)
ISO/IEC 27001
ISO/IEC 27701
NIST Privacy Framework
NIST Special Publication 800-53
SOC 2
How SmartSuite Supports China DSL
SmartSuite provides the system for managing controls, evidence, mappings, assessments, and reporting.
Use Compliance Management and Privacy Management records to hold the data classification catalog, important data inventory, risk assessment reports, incident log and the outbound transfer register.
Data Classification and Grading Catalog
Record each data set with its category, grade and whether it falls in a regulator's important data catalog (Article 21).
Data Security Management System
Keep the policies, training records and technical controls of the full-process system, with the designated data security lead and body (Article 27).
Risk Monitoring and Incident Reporting
Log vulnerabilities, incidents, user notices and reports to authorities with dates and owners (Article 29).
Periodic Risk Assessment Reports
Schedule the periodic assessment of important data and keep the report to the competent authority and its supporting evidence (Article 30).
Outbound Transfer and Foreign Request Register
Record each outbound transfer with its approval or assessment status and any foreign data request with its handling decision (Articles 31 and 36).
Data Security Readiness Reporting
Show classification coverage, open risks and assessment status for leadership and counsel on a dashboard.
Related frameworks
China's PIPL sets seven legal bases, separate consent, impact assessments and three export routes, with fines of up to RMB 50 million or 5 percent of revenue.
COBIT 2019 is ISACA's framework for governing and managing enterprise IT, with 40 objectives in five domains, six governance principles and 11 design factors.
The GDPR (Regulation (EU) 2016/679) sets principles, lawful bases, individual rights and accountability duties for personal data, with fines up to EUR 20 million or 4 percent of turnover.
ISO/IEC 27001:2022 specifies requirements for an information security management system: Clauses 4 to 10, risk treatment, the Statement of Applicability and 93 Annex A controls.
ISO/IEC 27701:2025 specifies requirements for a stand-alone privacy information management system (PIMS) for PII controllers and processors, replacing the 2019 edition.
The NIST Privacy Framework Version 1.0 is a voluntary tool for managing privacy risk: five Functions, 18 Categories, 100 Subcategories, Profiles and four Implementation Tiers.
Frequently Asked Questions For China Data Security Law (DSL)
It is China's statute for data security, effective September 1, 2021. It requires organizations that handle data in mainland China to classify and grade data, protect important data and core national data more strictly, report incidents and control outbound transfers.
Article 21 sets categorized and graded protection by the importance of the data and the harm from tampering, destruction, leakage or illegal use. Regions and departments publish catalogs of important data. Data tied to national security, economic lifelines, key livelihoods and major public interests is core national data and is managed more strictly.
They designate a data security lead and a management body (Article 27) and carry out periodic risk assessments, sending reports on data types and volume, handling activities, risks and countermeasures to the competent authority (Article 30).
Not without approval. Article 36 says organizations and individuals in mainland China may not provide data stored in mainland China to foreign judicial or law enforcement bodies without approval from the competent Chinese authority.
Failing the duties in Articles 27, 29 or 30 draws fines of RMB 50,000 to 500,000, or RMB 500,000 to 2 million in serious cases. Unlawful outbound transfers of important data can draw RMB 100,000 to 1 million, or RMB 1 to 10 million in serious cases (Articles 45 and 46).
Put this framework to work in SmartSuite
Manage controls, risks, evidence, and audits in one platform designed for modern governance, risk, and compliance.