China’s data protection system rests on three principal statutes. The Cybersecurity Law (CSL) of 2017 established baseline network security obligations and data-localisation rules for critical information infrastructure operators. The Data Security Law (DSL) of 2021 introduced a tiered data-classification scheme: core, important, and general, and imposed security review requirements on cross-border transfers of important data.
The Personal Information Protection Law (PIPL), also effective in 2021, mirrors many GDPR principles by granting individuals rights over their personal information and requiring a lawful basis for processing. Together, these three laws create a comprehensive regime that covers network security, data governance, and personal-data protection.
The Cyberspace Administration of China (CAC) serves as the lead regulator, overseeing cross-border data transfers, security assessments, and algorithm registrations. Sector-specific regulators, such as the Ministry of Industry and Information Technology for telecoms and the People’s Bank of China for financial data, add further requirements.
Penalties for violations range from warnings and fines to app removals and criminal liability for senior executives. The enforcement landscape is active; high-profile cases have targeted both domestic tech giants and foreign companies for consent failures and excessive data collection.
Multinational businesses should begin by mapping personal-data flows that touch Chinese data subjects. Implement a consent management platform like Seers.ai to collect purpose-specific consent in Mandarin, store consent records, and automatically block non-essential cookies when consent is withheld.
For cross-border transfers, pair CMP records with the relevant legal mechanism, CAC security assessment, standard contractual clauses, or certification, to build a defensible compliance programme.
Manage China privacy requirements effortlessly with Seers AI
START FREE TODAY