Compliance

important data

Data whose tampering, leakage or loss may harm national security or public interests.

How the laws define this

Every cited regulatory framework establishes that important data encompasses information whose compromise threatens national security, economic stability or development, and public interests. Under these rules, classifying data as important triggers enhanced governance, including special protection measures, risk assessments, and restrictions on cross-border movement. The primary divergence lies in how the term is operationalized and defined across individual instruments. The Regulations on Network Data Security Management (网络数据安全管理条例) explicitly relies on formal national, sectoral, or local catalogues to identify covered data types. By contrast, the Data Security Law of the People's Republic of China defines the status based on potential harm to economic lifelines and public livelihoods to require designated responsible persons, whereas the Security Assessment Measures for Outbound Data Transfers (Measures for the Security Assessment of Outbound Data Transfers) focuses on potential risks to public health, safety, or social stability specifically to mandate outbound security assessments.

Synthesised from the 4 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
China	Data Security Law of the People's Republic of China	In Force	Explicitly includes impacts on economic lifelines and people’s livelihoods alongside national security and public interests, and specifies graded protection, designated responsible persons, and reporting obligations.
China	Measures for the Security Assessment of Outbound Data Transfers	In Force	Broadens harm to include social stability and public health or safety beyond national security and public interests.
China	Regulations on Network Data Security Management	In Force	Introduces identification via national, sectoral or local catalogues and emphasizes registration, declaration, and pre-transfer risk assessments.
China	Cybersecurity Law of the People's Republic of China	In Force (Amended)	Frames importance in terms of national security, economic development, and other significant functions, linking to special classification and cross-border transfer controls.

What it triggers

Under China's Data Security Law, processors must implement graded protection, designate responsible persons, conduct risk assessments, and fulfill reporting obligations.source
Under Measures for the Security Assessment of Outbound Data Transfers, processors must conduct security assessments and obtain approval before transferring data outside China.source
Under Regulations on Network Data Security Management, processors must apply enhanced governance, register or declare holdings, perform pre-transfer risk assessments, and comply with stricter technical and contractual safeguards.source
Under the Cybersecurity Law of the People's Republic of China, such data is subject to special classification and governance measures including storage, protection, and controlled cross-border transfer.source

Definitions (4)

Data identified by its importance and the potential harm caused by its tampering, leakage or loss — including impacts on national security, economic lifelines, major public interests and people’s livelihoods; such data are subject to graded protection, designated responsible persons, risk assessments and reporting obligations.

Data Security Law of the People's Republic of ChinaDefinition 1 of 4

Data which, if tampered with, leaked, or illegally obtained or used, may endanger national security, economic operation, social stability, public health or safety; designation that triggers mandatory outbound transfer security assessment obligations and enhanced safeguards under the Measures.

Security Assessment Measures for Outbound Data Transfers (Measures for the Security Assessment of Outbound Data Transfers)Definition 2 of 4

Data types or datasets that competent authorities identify in national, sectoral or local catalogues as having significance for economic security, public interests or national security; processors of such data must apply enhanced governance, register or declare holdings, perform pre‑transfer risk assessments, and comply with stricter technical and contractual safeguards.

Regulations on Network Data Security Management (网络数据安全管理条例)Definition 3 of 4

Data that, by reason of its importance to national security, economic development, social public interests or other significant functions, is subject to special classification and governance measures (including storage, protection and controlled cross‑border transfer) coordinated under the Cybersecurity Law and the Data Security Law.

Cybersecurity Law of the People's Republic of ChinaDefinition 4 of 4

Not to be confused with

core data

Core data is a stricter subset of important data with additional rules, while important data covers broader categories of significant data.

Critical Personal Data

Critical personal data specifically concerns personal information deemed critical to national security or public interests, whereas important data encompasses non-personal data as well.

Questions and answers

What obligations apply to important data processors under China's Data Security Law?

Processors must implement graded protection, designate responsible persons, conduct risk assessments, and meet reporting obligations. This applies to data whose tampering, leakage or loss impacts national security, economic lifelines, major public interests or people’s livelihoods.

When is a security assessment required for outbound transfers of important data?

Processors must perform self-assessments and obtain approval for transfers outside China if the data, when tampered with, leaked, or illegally used, endangers national security, economic operation, social stability, public health or safety.

How are important data holdings managed under the Regulations on Network Data Security Management?

Competent authorities identify important data in catalogues, requiring processors to apply enhanced governance, register or declare holdings, conduct pre-transfer risk assessments, and follow stricter safeguards.