Cybersecurity law & regulation in China (2026)
Cybersecurity in China: comprehensive law.
China operates one of the world's most comprehensive and prescriptive cybersecurity regimes, built on the CSL, DSL and PIPL trilogy and enforced by the CAC together with the Ministry of Public Security and sector regulators. The CSL was substantively amended in October 2025 (in force 1 January 2026) to sharpen penalties, expand extra-territorial enforcement, and add an AI-governance track; a unified national cybersecurity incident-reporting regime took effect on 1 November 2025 with strict short-window reporting timelines. Operators of Critical Information Infrastructure (CIIOs), network operators graded under the Multi-Level Protection Scheme (MLPS 2.0), and personal-information processors face layered obligations including localization, security assessments, and cross-border transfer controls.
Legal framework
Cybersecurity Law (CSL, 2017; amended effective 1 Jan 2026), Data Security Law (DSL, 2021) and Personal Information Protection Law (PIPL, 2021), administered principally by the Cyberspace Administration of China (CAC), with supporting rules on CII protection, MLPS 2.0, cross-border data flows and incident reporting.
Key points: cybersecurity in China
Cybersecurity Law amendment in force 2026
The Standing Committee of the NPC adopted amendments to the CSL in October 2025 that took effect 1 January 2026, recalibrating penalties, aligning liability with the DSL/PIPL, expanding extra-territorial enforcement, and adding a new Article 20 supporting AI R&D and governance.
Unified incident-reporting regime (Nov 2025)
The CAC's Administrative Measures for National Cybersecurity Incident Reporting entered into force on 1 November 2025, requiring general network operators to report qualifying incidents within 4 hours and CIIOs within 1 hour; sector regulators must escalate 'major' or 'particularly major' incidents to national CAC and MPS within 30 minutes, with a full handling report due within 30 days.
Critical Information Infrastructure & MLPS 2.0
CIIOs designated by sector regulators under the CII Protection Regulations must localize personal information and important data in China, establish dedicated security bodies, and pass CAC security review for cross-border transfers. In parallel, MLPS 2.0 (in force since December 2019) grades systems 1-5, requiring filing at Level 2+ and third-party certification at Level 3+ (annual re-assessment).
Personal Information Protection Law enforcement
The PIPL is enforced by the CAC and provides for administrative fines of up to RMB 50 million or 5% of prior-year turnover. The CAC's Administrative Measures for Personal Information Protection Compliance Audits took effect 1 May 2025, and 2025 saw high-profile cross-border-transfer enforcement, including the September 2025 action against the Shanghai subsidiary of a European luxury brand for unlawfully exporting customer data to France.
Cross-border data transfer regime
The March 2024 Provisions on Promoting and Regulating Cross-border Data Flows relaxed thresholds but retained three pathways: CAC security assessment (mandatory for 'important data', CIIOs, or high-volume PI transfers), CAC-filed Standard Contract, and PI Protection Certification. The joint CAC/SAMR Measures for Certification of Cross-Border Personal Information Transfer took effect 1 January 2026, completing the framework.
Data Security Law and 'important data'
The DSL (in force September 2021) establishes a hierarchical data-classification system (general/important/core/national-core data), imposes special protection duties on 'important data' handlers including risk assessments and CAC security assessment before export, and prohibits providing data stored in China to foreign judicial or law-enforcement bodies without Chinese government approval.
Timeline of decisions
- LawAmended Cybersecurity Law takes effect
Amendments adopted by the NPC Standing Committee on Oct. 28, 2025 raise maximum fines to RMB 10 million, allow immediate penalties without prior warning, and broaden extraterritorial enforcement to any overseas activity endangering China's cybersecurity. It significantly hardens the original 2017 framework.
Reed Smith
- Law · officialAmended Cybersecurity Law takes effect
The first revision since 2017 (adopted by the NPC Standing Committee on 2025-10-28) raises maximum fines to RMB 10 million, expands extraterritorial reach to any activity endangering China's cybersecurity, and adds an article on safe AI development. It signals tighter integration of content, data, and AI governance.
State Council Information Office
- Law · officialAmended Cybersecurity Law takes effect
The first major overhaul of the 2017 CSL raises maximum fines to RMB 10 million, aligns penalties with the PIPL, broadens extraterritorial enforcement, and adds AI governance provisions. It marks a tightening and consolidation of China's data/cyber enforcement regime.
U.S. Library of Congress (Global Legal Monitor)
- LawNetwork Data Security Management Regulations issued
The State Council issued national-level regulations (effective Jan. 1, 2025) implementing the CSL, DSL and PIPL together, setting unified rules on important data, network data handlers, and cross-border transfers. It consolidates China's three core data laws into one operational framework.
China Briefing
- Guidance · officialProvisions on Promoting and Regulating Cross-Border Data Flows
The CAC released rules taking immediate effect that ease outbound data transfer requirements, exempting six scenarios from security assessment/certification and raising volume thresholds. It marked a notable relaxation of the strict 2022 cross-border regime.
Library of Congress
- Law · officialCross-Border Data Transfer Security Assessment Measures take effect
CAC measures finalized July 7, 2022 require a government security assessment before exporting important data, or personal information above set thresholds, out of China. It established the first mandatory state review gate for outbound data.
Library of Congress
- EnforcementDidi Global fined RMB 8.026 billion
After a year-long cybersecurity review, the CAC found 16 violations of the CSL, DSL and PIPL and fined Didi RMB 8.026 billion plus RMB 1 million each on its chairman and CEO. It was the landmark first major enforcement case under the new data laws.
DigiChina (CAC statement translation)
- LawData Security Law (DSL) takes effect
Adopted June 10, 2021, the DSL created a national data classification and grading system, introduced 'important data' and 'national core data' regimes, and imposed data-handling security obligations across all sectors. It anchors data security alongside the CSL.
Skadden
- Law · officialCritical Information Infrastructure Security Protection Regulations take effect
The State Council's first administrative regulations on CII (released Aug. 17, 2021) defined critical sectors, designated protection authorities, and set operator obligations. They operationalized the CII concept introduced in the 2016 Cybersecurity Law.
The State Council (gov.cn)
- Law · officialData Security Law takes effect
Adopted by the NPC on 2021-06-10, the DSL establishes a national data-classification and security framework treating data as a national-security concern and restricting cross-border data transfers. It expanded state control over data flowing through online services.
National People's Congress
- GuidanceMulti-Level Protection Scheme (MLPS 2.0) standards take effect
Ministry of Public Security national standards (GB/T 22239-2019 and others) updated the classified protection regime, requiring operators to grade systems across five levels and obtain assessments for Level 2+ systems. It became the core technical compliance baseline under the CSL.
Inside Privacy (Covington)
- LawCybersecurity Law takes effect
China's foundational cybersecurity statute imposed network operator security duties, data localization for critical information infrastructure, real-name registration, and the multi-level protection scheme. It established the structural framework all later data laws build upon.
DigiChina (Stanford)
- LawCybersecurity Law takes effect
China's first overarching cyber law introduced data-localization for critical information infrastructure, network-operator security duties and early personal-information protection rules, the foundation of the data-governance architecture.
Wikipedia (CSL overview)
- LawCybersecurity Law adopted by NPC Standing Committee
The National People's Congress Standing Committee passed China's first unified cybersecurity law, designating the Cyberspace Administration of China as lead regulator. Its passage marked the formal birth of China's modern cybersecurity legal regime.
NPC Observer
Sources
- gtlaw.com/en/insights/2026/2/chinas-amended-cybersecurity-law-takes-effect
- china-briefing.com/news/china-cybersecurity-law-amendment/
- twobirds.com/en/insights/2026/china/key-revisions-and-compliance-recommendations-o
- mayerbrown.com/en/insights/publications/2025/12/chinas-cybersecurity-incident-report
- lw.com/en/insights/china-cac-announces-new-cybersecurity-incident-reporting-
- privacymatters.dlapiper.com/2025/09/china-new-stricter-and-4-hour-data-breach-reporting-requireme
- digichina.stanford.edu/work/after-5-years-chinas-cybersecurity-rules-for-critical-infrastruc
- mayerbrown.com/en/insights/publications/2025/04/china-finalises-the-measures-for-per
- arnoldporter.com/en/perspectives/advisories/2025/10/china-data-privacy-enforcement-cro
- arnoldporter.com/en/perspectives/advisories/2025/11/china-issues-clarifications-cross-
- mofo.com/resources/insights/250609-china-s-new-cbdt-regime-one-year-on
- china-briefing.com/news/china-clarifies-cross-border-data-transfer-rules-official-qa/
- lexology.com/library/detail.aspx?g=2e3444c9-aed5-43d6-969e-23dac4b30a37
- dlapiperdataprotection.com/countries/china/transfer.html
- practiceguides.chambers.com/practice-guides/cybersecurity-2026/china/trends-and-developments
- assets.kpmg.com/content/dam/kpmg/cn/pdf/en/2019/05/mlps-insights-strategies.pdf
- protiviti.com/au-en/whitepaper/chinas-cybersecurity-law-multiple-level-protection-s
- iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-4-penalties-and-
- oercs.berkeley.edu/privacy/selected-privacy-policies-and-regulations/international-priva
Next for China: Starting a BusinessModerate
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 28 Aug 2026. Methodology & how to cite · State of Technology Regulation 2026