China - Network Data Security Management (Decree No. 790)

Overview

The Regulations on Network Data Security Management (网络数据安全管理条例) were promulgated by the State Council (Decree No.790) on 24 September 2024 and entered into force on 1 January 2025. The Regulation establishes detailed administrative rules to implement and harmonize key provisions of the Cybersecurity Law, Data Security Law and Personal Information Protection Law, focusing on classification and graded protection of network data, obligations of network data processors (including platform operators), rules for cross-border transfers and processes for incident response and national security review. For the official promulgation text see State Council Gazette (Chinese) and the English summary on the central government portal gov.cn (English). (gov.cn)

Definitions

Key defined terms include "network data" (encompassing both personal and non-personal data generated by networks), "personal information" (as in PIPL), "important data" (data designated by competent authorities for heightened protection), "core data" (subject to additional rules), "joint handling" and "entrusted processing". "Large network platform" is defined by three cumulative attributes: scale (registered users over 50 million or monthly active users over 10 million), complexity of business types, and the societal/national impact of its data processing activities. The Regulation also adopts familiar PIPL concepts such as sensitive information and separate (specific) consent. (gov.cn)

Governance and Institutional Framework

The Regulation emphasizes a multi-agency governance model: the national data security coordination mechanism and relevant departments will coordinate important-data catalogues, risk review mechanisms and enforcement. At enterprise level, entities processing important data must appoint a network data security director and set up a dedicated data security management body; these bodies are tasked with drafting and implementing internal data security management rules, emergency response plans, risk monitoring and audits. Regulators named in implementing materials and Q&A documents include the Cyberspace Administration of China (网信办), public security authorities, market regulators, industry ministries and local-level competent departments; the Ministry of Justice and CAC have issued explanatory materials to clarify obligations and the administrative relationships. See the official promulgation and related Q&A for further institutional guidance: State Council Gazette (Chinese) and Ministry of Justice Q&A. (gov.cn)

Key Focus Areas

The Regulation addresses multiple focus areas: (1) Data classification and graded protection: competent authorities will publish important-data catalogues at national, sectoral and local levels and processors must identify and declare important data. (2) Organizational and technical controls: encryption, access management, backups, authentication and logging are mandated; processors must implement security-by-design and security-by-default measures. (3) Governance obligations: recordkeeping, contracts for cross-entity processing, pre-transfer risk assessments for important data, background checks for staff in critical roles, and routine compliance audits are required. (4) Platform governance: platform service providers have duties to monitor third-party processors on their platforms, and large platforms (by scale and impact) are subject to gatekeeping obligations including annual social-responsibility reporting on personal-data protection and prohibitions against abusing algorithmbased restrictions or discriminatory treatments. (5) Incident response and reporting: entities must have incident plans, report to regulators within prescribed timeframes for incidents affecting national security/public interest, and notify affected individuals when their rights are harmed. (6) Cross-border data flows: outbound transfers of important data or large-volume personal data remain subject to national security assessments, contractual safeguards and other procedural controls; the Regulation reiterates that data are not important by default unless designated by authorities. These focus areas align the Regulation with existing PRC data and cybersecurity laws while offering more detailed administrative obligations. (gov.cn)

Implementation Framework

Implementation rests on (a) administrative designation of important data lists at national and local levels; (b) enterprise-level compliance: systems, appointed responsible person, internal rules, contracts, technical measures, audits and employee vetting; and (c) supervisory measures by CAC and other competent departments. Important-data processors and large platforms must perform pre-transfer and annual risk assessments, retain processing records (at least three years for certain outsourced processing), and, in some cases, submit assessment reports to provincial-or-above authorities. The Regulation also contemplates implementing regulations and guidance by specialized agencies (e.g., CAC and MIIT) to clarify operational thresholds and reporting formats. Practitioners should prepare by mapping data holdings, inventorying processing activities, updating contracts and technical controls, and planning for required reporting and audits. (gov.cn)

Monitoring and Evaluation

Supervision will be performed by a combination of national and local authorities coordinated by the national data security mechanism. Monitoring tools include mandatory reporting, submission of risk-assessment reports, on-site inspections, compliance audits and public reporting obligations for large platforms. The Regulation requires annual risk assessments for important-data processors and provides for periodic audits (self-audits or thirdparty audits). Regulators retain discretion to publish guidance on sampling, thresholds and technical standards; industry organizations are encouraged to adopt codes of conduct to supplement official supervision. (gov.cn)

Penalties, Liability, and Appeals

The Regulation reiterates administrative enforcement measures consistent with PRC administrative law and related data laws: orders to correct, warnings, fines, confiscation of illegal gains, suspension of business, license revocation and public censure. For severe breaches implicating national security or criminal offenses, agencies may transfer cases to public security organs and state security authorities for criminal investigation. Article provisions allow mitigation or exemption of administrative penalties where violations are minor, promptly corrected, and do not cause harm. Entities should maintain records to support mitigation claims and prepare internal appeal channels aligned with administrative procedures. (gov.cn)

Relationship to Other Instruments

The Regulation is explicitly drafted to implement and be consistent with the Cybersecurity Law, Data Security Law and PIPL. It provides administrative-level operational rules and further detail (for example, thresholds, recordkeeping periods and reporting obligations) that supplement those laws. It also references national standards (including mandatory requirements under China’s graded protection system) and anticipates supplementary measures and implementing rules from sector regulators and CAC; in some domains (state secrets, work secrets) other laws (e.g., State Secrets Law) continue to apply. Relevant implementing measures already published or expected include CAC guidance on cross-border transfers and audits. (gov.cn)

International Alignment

The Regulation signals China’s intent to strengthen domestic data governance while participating in international rule-making and technical standard-setting. It reaffirms the state’s interest in cross-border data-security mechanisms but also tightens administrative controls on the outbound transfer of important data and large-volume personal data. The Regulation’s design—designation-by-authority (rather than automatic classification), required contractual and technical safeguards, and sectoral catalogues—creates both points of alignment with international good practices (risk assessment, DPIA-equivalent audits, transparency obligations) and points of divergence (administrative designation, national-security review, stricter gatekeeper duties for platforms). Multinational entities should map regulatory overlaps and watch for implementing rules and negative/positive lists from CAC and commerce authorities. (gov.cn)

Implementation Timeline

Sources and References