Overview of the Data Security Law of the People’s Republic of China
The Data Security Law of the People’s Republic of China (DSL), enacted on September 1, 2021, establishes a comprehensive framework for the governance of data activities within China. It regulates the creation, processing, storage, transfer, and utilization of data, with a particular emphasis on safeguarding national security and public interests. The DSL operates in tandem with other key legislative instruments, including the Personal Information Protection Law (PIPL) and the Cybersecurity Law, forming an interconnected legal system aimed at strengthening data sovereignty and control over critical information flows.
The law was introduced as part of China’s broader response to extraterritorial legal measures, such as the U.S. CLOUD Act of 2018, which permitted foreign law enforcement to access data stored by U.S.-based companies outside U.S. jurisdiction. The DSL reflects China’s efforts to mitigate risks associated with foreign data requests while reinforcing domestic regulatory authority over sensitive information.
The DSL applies primarily to technology companies and organizations handling large-scale data operations, though its provisions extend to all entities engaged in data-related activities within China. Its implementation aligns with China’s broader national security agenda, particularly under the administration of Xi Jinping, where data is increasingly recognized as a strategic asset requiring stringent protection.
Classification and Protection of Data
The DSL categorizes data into distinct tiers based on its sensitivity and importance to national security, economic stability, and public welfare. Core data—defined broadly to include information related to national security, economic security, citizens’ livelihoods, and significant public interests—receives the highest level of protection. This classification system mandates that core data must be stored within China’s borders, subject to localization requirements that restrict cross-border transfers without prior approval.
Important data, while not as strictly controlled as core data, still requires adherence to security assessments and compliance with regulatory oversight. The law imposes obligations on organizations to conduct risk assessments before transferring data, particularly when dealing with foreign entities or jurisdictions. Unauthorized provision of data to foreign law enforcement or judicial authorities is prohibited unless explicit approval is obtained from Chinese competent authorities.
Article 36 of the DSL explicitly states that domestic organizations and individuals may not supply data stored in mainland China to foreign judicial or law enforcement agencies without prior authorization from Chinese regulatory bodies. This provision underscores China’s sovereignty over its data ecosystem and aligns with broader efforts to prevent foreign interference in domestic data governance.
Cross-Border Data Transfer and Regulatory Developments
Initially, the law imposed stringent controls on data exports, particularly for core and important data categories. However, the Cyberspace Administration of China (CAC) introduced the Provisions on the Regulation and Promotion of Cross-Border Data Flows in September 2023, which introduced a more nuanced approach to data transfers.
Under the 2023 draft and the finalized provisions effective March 2024, data exports no longer universally require government oversight unless the data is classified as important by regulators. This shift aims to streamline cross-border data flows while maintaining compliance with the DSL, PIPL, and Cybersecurity Law. The CAC-led review process for data exports remains in place for cases where regulatory scrutiny is deemed necessary, ensuring that sensitive information continues to be protected.
The integration of obligations across these laws reflects China’s commitment to harmonizing its regulatory framework. Organizations must now navigate a consolidated set of rules governing data security, privacy, and cybersecurity, which collectively impose stricter compliance burdens on both domestic and international entities operating in China.
Implications for Businesses and International Collaboration
The DSL has had significant repercussions for international businesses, particularly those in the technology sector. Legal experts, such as Carolyn Bigg of DLA Piper Hong Kong, have noted that the DSL adds another layer of regulatory complexity, making it increasingly difficult for multinational corporations to operate within China without careful legal and technical planning.
Institutions such as the German Research Foundation, the Swedish Research Council, and the Swiss National Science Foundation have avoided co-funding projects in China due to concerns over potential violations of the law’s vaguely defined provisions.
Chinese technology companies, including Meituan, Alibaba, and Ant Financial, faced heightened regulatory scrutiny in the lead-up to the DSL’s enactment.
Required actions
- Classify data into general, important and core categories and apply matching protection; important-data processors must appoint a security lead and carry out risk assessments - Obtain approval before providing data stored in China to foreign judicial or law-enforcement bodies - Do not process data in ways that harm national security; comply with export controls on controlled data