Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

China Network Data Security Regulations

In force China · In force Jan 1, 2025 · no upcoming deadlines

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Takes effectJan 1, 2025 · 22 months ago · Source
Network Data Regulations take effectAll provisions, including the 10-million-person threshold duties and annual important-data risk assessments, apply.

Summaries for reference, not legal advice. Check the official text.

What it does

Implementing regulations under the CSL, DSL and PIPL covering personal information, important data, cross-border data and platform duties. Processors of PI of 10 million+ people must also meet important-data processor duties, such as naming a security lead and filing annual risk assessments. Platforms must offer an easy opt-out from personalized recommendations.

Who it applies to
Network data processing activities in China, plus offshore processing of data of people in China that harms national security or public interest. Processors of PI of 10 million or more individuals take on the important-data duties in Arts. 30 and 32 (Art. 28). Important-data processors must file annual risk assessment reports with provincial-level regulators (Art. 33).
Penalties
Violating specified articles (e.g. Arts. 12, 16-20, 22, 40-42): warning and confiscation, and for refusal or serious cases fines up to RMB 1 million plus possible suspension or license revocation; responsible individuals RMB 10,000-100,000 (Art. 55). Other violations are punished under the CSL, DSL and PIPL.
Enforced by
CAC, telecom, public security and other competent departments
Official name
Regulations on Network Data Security Management (State Council Order No. 790)
Citation
State Council Order No. 790
Topics
Privacy, Cybersecurity, Data residency
Verified 2026-09-22 cac.gov.cn
Research notes

Adopted at the State Council executive meeting of 2024-08-30, signed as Order No. 790 on 2024-09-24, published 2024-09-30. Annual risk assessment timing is 'each year' with no fixed calendar date.

Related

In forceAustralia
Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024
AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
AmendedAustralia
Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018
In forceChina
China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024
In forceChina
China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025
Questions about China Network Data Security Regulations
What are the China Network Data Security Regulations compliance deadlines?
Jan 1, 2025: Network Data Regulations take effect.
When does China Network Data Security Regulations take effect?
China Network Data Security Regulations took effect on Jan 1, 2025.
Who does China Network Data Security Regulations apply to?
Network data processing activities in China, plus offshore processing of data of people in China that harms national security or public interest. Processors of PI of 10 million or more individuals take on the important-data duties in Arts. 30 and 32 (Art. 28). Important-data processors must file annual risk assessment reports with provincial-level regulators (Art. 33).
What are the penalties under China Network Data Security Regulations?
Violating specified articles (e.g. Arts. 12, 16-20, 22, 40-42): warning and confiscation, and for refusal or serious cases fines up to RMB 1 million plus possible suspension or license revocation; responsible individuals RMB 10,000-100,000 (Art. 55). Other violations are punished under the CSL, DSL and PIPL.