China - Cybersecurity Law (2016)

Overview

The Cybersecurity Law of the People’s Republic of China is the foundational national statute setting out obligations for network security, operation safety, data governance, and state supervision in China. Adopted by the Standing Committee of the National People’s Congress on 7 November 2016 and promulgated by Presidential Order No. 53, the law entered into force on 1 June 2017. It establishes core principles such as cyberspace sovereignty and the coordinated pursuit of development and security under a network security graded protection framework.

On 28 October 2025, the NPC Standing Committee adopted a decision to amend the law, which took effect on 1 January 2026 under Presidential Order No. 61. The 2025 revision introduces explicit provisions for artificial intelligence governance, expands extraterritorial jurisdiction, and increases administrative fine thresholds. Official texts are published by the Cyberspace Administration of China and on the State Council portal.

Definitions

Key defined or operational terms in the law include: "network" (the infrastructure and systems enabling data exchange and service provision), "network operator" (entities that construct, operate, maintain or use networks), "network product/service providers" (suppliers of hardware, software and services used in networks), "network security" (measures to protect network operation, data confidentiality, integrity and availability), "Critical Information Infrastructure / CII" (infrastructure in sectors where damage would seriously harm national security, economy or public interest, including public communications, energy, transport, water conservancy, finance, public services and e-government), "personal information" and "important data" (terms whose handling is regulated in cooperation with other laws such as the Personal Information Protection Law and Data Security Law). The law sets responsibilities for operators and regulators, and references other laws for detailed definitions of personal information and data categories.

Governance and Institutional Framework

The law assigns central coordination and supervisory roles to national-level institutions and establishes a cross-sector governance model. The principal coordinating body is the national cyberspace authority; sectoral regulators such as the Ministry of Industry and Information Technology (MIIT), public security organs and relevant State Council departments perform duties within their statutory functions. Local governments are charged with implementing network security work within their jurisdictions. The law authorizes national standards-setting, certification and testing frameworks, encourages industry self-regulation and socialized services (testing, certification, risk assessment) and mandates inter-agency cooperation on CII protection and security reviews. Official portals that publish the law and related guidance include the Cyberspace Administration of China (for central cybersecurity policy and implementation guidance) and the central government portal; see CAC - Cybersecurity Law Text and the State Council publication of the promulgation at Government of China - Presidential Order.

Key Focus Areas

The law’s substantive obligations fall into several clusters. First, network operation safety: operators must adopt graded protection measures under the network security graded protection framework (establish security management systems, appoint security officers, apply technical defenses, backup and disaster recovery, and log retention for not less than six months). Second, CII protection: operators of designated CIIs must establish specialized security management institutions, carry out background checks for critical personnel, conduct annual security assessments, and ensure domestic storage of personal information and important data generated or collected within China (with procedures for approved cross-border transfers). Third, product and service security: network products and security-specific products must meet mandatory national standards and pass qualified certification and security testing before sale or supply; vendors must eliminate malicious code, promptly fix detected vulnerabilities and provide continuing security maintenance. Fourth, data governance and personal information control: while the Cybersecurity Law provides high-level requirements (including domestic storage of CII data and procedures for security assessment for cross-border transfers), the detailed rules on personal data protection are coordinated with the Personal Information Protection Law (PIPL) and Data Security Law (DSL). Fifth, incident reporting, monitoring and emergency response: network operators must prepare contingency plans, report major incidents to competent authorities and to affected users, and cooperate in investigations. Sixth, law enforcement cooperation: the law requires technical support and assistance for public security and national security bodies conducting lawful investigations. These thematic obligations are described in the statutory text and in implementing measures published by regulators; see the law text at CAC - Cybersecurity Law and regulatory announcements.

Implementation Framework

Implementation relies on a layered mix of national law, sectoral regulations, national standards, and administrative measures. The national cyberspace authority and sectoral ministries issue detailed rules governing critical information infrastructure identification, security certification, and security assessments for cross-border data transfers.

The 2025 amendment introduced explicit provisions supporting artificial intelligence research and infrastructure alongside mandatory ethical and security oversight, aligning cybersecurity governance with emerging AI risks. Official amendment details are available via the Cyberspace Administration of China.

Monitoring and Evaluation

The law mandates monitoring, logging and incident collection by network operators and authorizes regulators to conduct inspections, assessments and spot-checks. Monitoring includes operational logs (retained a minimum of six months by operators), vulnerability reporting and submission of assessment results for CII operators. Regulators may require rectification orders and can demand technical measures be taken. The law also supports the development of national standards and performance indicators and requires reporting of major incidents to competent authorities. Interagency coordination mechanisms are used for national-level monitoring, early warning and emergency response. Performance evaluation is realized through mandatory certification regimes, periodic assessments for CII and supervisory audits by sectoral regulators and CAC.

Penalties, Liability, and Appeals

The law provides administrative remedies and civil-liability pathways. Competent authorities can order correction, issue warnings, impose fines, suspend business or services, and revoke relevant permits. Article-level penalties were revised under the NPCSC decision of 28 October 2025 which updated prescribed fine ranges for general network operators and for CII operators (see the NPCSC decision at CAC - NPCSC Decision (2025) and the Presidential Order at gov.cn - Presidential Order No. 61). Individuals directly responsible for violations can also be fined. Affected parties have administrative and judicial remedies under PRC administrative procedure and civil litigation rules; appeal and review rights must be pursued according to ordinary administrative procedure law channels.

Relationship to Other Instruments

The Cybersecurity Law operates within a larger legislative ecosystem. It complements and interrelates with: the Personal Information Protection Law (PIPL) for individual data protection, the Data Security Law (DSL) for important data governance and classification, the National Intelligence Law and National Security Law for national-security-related obligations, and sectoral rules (telecommunications, finance, energy) that impose additional controls for critical sectors. Implementing and subsidiary measures (security certification rules, CII identification regulations, cross-border data transfer measures, vulnerability disclosure rules) elaborate the law’s operative obligations. For international businesses and cross-border activities, the Cybersecurity Law’s requirements on localization and security reviews interact closely with PIPL and DSL mechanisms for export and transfer of data across borders.

International Alignment

The law advances a model that emphasizes national cyberspace sovereignty, sectoral CII protection, domestic security review and controlled cross-border data flows. While the law’s goals (network resilience, data security and user protection) align with international cybersecurity objectives, specific measures (data localization for CII, security reviews of product procurement and cross-border transfers) differ in approach from some international data-flow liberalization frameworks. China’s regulatory architecture emphasizes state-oriented security review and extra-territorial controls in certain contexts; international stakeholders should map obligations against other regimes such as the EU’s NIS and GDPR frameworks to identify differences in scope, procedural safeguards and permitted cross-border channels. For official statements and coordination references see the Cyberspace Administration of China and State Council publications, e.g. CAC and the 2025 NPCSC decision at CAC (2025 amendment).

Implementation Timeline

Sources and References