ChinaCybersecurity Law, classified protection duties of a network operator
Cybersecurity Law of the People's Republic of China (as amended by the Decision of ), Art. 23
In force since .
A sector security regimes rule binding public and private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Security, Governance
As of .
What it requires
- This binds a network operator, meaning any organization that owns or manages a network or provides services over one, so it reaches every declared activity and every declared role; the level of protection follows the classification of the network under the classified protection system.
- Formulate internal security management rules and operating procedures, designate a person responsible for network security and put network security protection responsibility into effect (Article 23, item 1).
- Take technical measures against computer viruses, network attacks and network intrusions (Article 23, item 2).
- Monitor and record the network's operating status and security incidents and keep the network logs for not less than six months (Article 23, item 3).
- Take data classification, backup of important data and encryption measures (Article 23, item 4).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Penalty structure
Article 61's first paragraph sets a fine of 10,000 to 50,000 yuan on a network operator that fails to perform the Article 23 duties and, where it refuses to correct or the violation endangers network security, a fine of 50,000 to 500,000 yuan, plus 10,000 to 100,000 yuan on the directly responsible managers and other directly responsible persons. The same article's third and fourth paragraphs escalate the fine for a large-scale data leak or the loss of a function of critical information infrastructure, which this structure does not carry as a separate field.
- Rule
- Fixed only
- As of
- Currency
- CNY
- Fixed cap
- 500,000
Who enforces it
Enforcement body
The competent department with jurisdiction over the network operator, acting within the national coordination the Cyberspace Administration of China exercises over network-security work under Article 9 of the Law.
What this law does
Article 2 of the Cybersecurity Law applies to the construction, operation, maintenance and use of networks within China and to the supervision and administration of network security. Article 23 requires a network operator to perform the security protection duties that the classified protection system for cybersecurity sets. Article 23 requires the network operator to formulate internal security management rules and operating procedures and to designate a person responsible for network security.
Article 23 requires the network operator to take technical measures against computer viruses, network attacks and network intrusions. Article 23 requires the network operator to monitor and record the network's operating status and security incidents, to keep the network logs for not less than six months, and to take data classification, backup of important data and encryption measures.
Article 61 provides that a network operator that does not perform the Article 23 duties is ordered to correct, is warned, and may be fined 10,000 to 50,000 yuan. Article 81 states that the Law takes effect on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, publishes adult content, operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, records calls, records text chat or tracks devices.