What are the China Data Security Law compliance deadlines?

Sep 1, 2021: Data Security Law takes effect.

When does China Data Security Law take effect?

China Data Security Law took effect on Sep 1, 2021.

Who does China Data Security Law apply to?

All organizations and individuals carrying out data processing activities in China, plus offshore activities that harm China's national security or public interest. Important-data processors must appoint a data security officer and submit periodic risk assessments.

What are the penalties under China Data Security Law?

Failure to meet security duties: up to RMB 500,000, rising to RMB 500,000-2 million for refusal to correct or serious consequences such as large data leaks (Art. 45). Violating the national core data regime: RMB 2-10 million plus suspension or license revocation. Unlawful export of important data: RMB 100,000-1 million, up to RMB 10 million if serious (Art. 46).

China Data Security Law

In force China · In force Sep 1, 2021 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Takes effectSep 1, 2021 · 5.2 years ago · Source

Data Security Law takes effectData classification, important-data protection and data export restrictions apply (Art. 55).

Summaries for reference, not legal advice. Check the official text.

What it does

Sets up China's data classification and grading system, with heightened protection for 'important data' and 'core data'. Requires data processors to run data security management systems, risk monitoring and incident handling, and restricts giving data stored in China to foreign judicial or law-enforcement bodies without approval.

Who it applies to: All organizations and individuals carrying out data processing activities in China, plus offshore activities that harm China's national security or public interest. Important-data processors must appoint a data security officer and submit periodic risk assessments.
Penalties: Failure to meet security duties: up to RMB 500,000, rising to RMB 500,000-2 million for refusal to correct or serious consequences such as large data leaks (Art. 45). Violating the national core data regime: RMB 2-10 million plus suspension or license revocation. Unlawful export of important data: RMB 100,000-1 million, up to RMB 10 million if serious (Art. 46).
Enforced by: Sector regulators, public security and national security authorities; CAC coordinates network data security
Official name: Data Security Law of the People's Republic of China
Citation: Order of the President of the PRC No. 84
Topics: Cybersecurity, Data residency, Data access and sharing

Verified 2026-09-22

Research notes

Important-data catalogs are issued by region and sector; the Network Data Security Management Regulations (effective 2025-01-01) detail important-data processor duties such as annual risk assessments.

In forceAustralia

Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024

AmendedAustralia

Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018

In forceChina

China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025

In forceChina

China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022

In forceChina

China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026

In forceChina

China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024

In forceChina

China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025

AmendedChina

China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017

Questions about China Data Security Law

What are the China Data Security Law compliance deadlines?: Sep 1, 2021: Data Security Law takes effect.
When does China Data Security Law take effect?: China Data Security Law took effect on Sep 1, 2021.
Who does China Data Security Law apply to?: All organizations and individuals carrying out data processing activities in China, plus offshore activities that harm China's national security or public interest. Important-data processors must appoint a data security officer and submit periodic risk assessments.
What are the penalties under China Data Security Law?: Failure to meet security duties: up to RMB 500,000, rising to RMB 500,000-2 million for refusal to correct or serious consequences such as large data leaks (Art. 45). Violating the national core data regime: RMB 2-10 million plus suspension or license revocation. Unlawful export of important data: RMB 100,000-1 million, up to RMB 10 million if serious (Art. 46).

Deadlines

What it does

Related