Law / China

Data Security Law, Data Security Protection Obligations

Data Security Law of the People's Republic of China, Art. 27

In force since 1 Sep 2021.

A security baseline statutes rule binding private bodies.

Obligation class: Security, Governance

What it requires

This binds any organization or individual engaging in a data-processing activity, regardless of sector, and reaches data generally rather than only personal information.
Establish and maintain a full-process data-security management system covering the collection, storage, use, processing, transmission, provision, and disclosure of the data you process, and provide data-security education and training to your staff.NIST CSF 2.0GV.PO-01 NIST CSF 2.0PR.AT-01
Take the technical measures and other necessary measures appropriate to your processing to keep your data secure.NIST CSF 2.0PR.DS-01
Where you process data over the internet or another information network, meet this duty in addition to, not instead of, your classified-protection obligations under the Cybersecurity Law, already this jurisdiction's own deferred network-operator duty.
If you process important data, an official classification this corpus cannot flag against on its own, designate a person responsible for data security and a managing body, and implement that responsibility.NIST CSF 2.0GV.RR-02

These lines are LexLint's reading of the law's text.

In the frameworks

NIST Privacy Framework

PR.DS-P5Protections against data leaks are implemented.

NIST CSF 2.0

GV.RR-02Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced
GV.PO-01Policy for managing cybersecurity risks is established based on organizational context, cybersecurity strategy, and priorities and is communicated and enforced
PR.AT-01Personnel are provided with awareness and training so that they possess the knowledge and skills to perform general tasks with cybersecurity risks in mind
PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected

CIS Controls

3.2A maintained catalogue of the sensitive data the enterprise holds and where it sits.
3.10Encryption of sensitive data as it crosses networks.
3.11Encryption of sensitive data where it is stored on servers and applications.
6.8Access rights defined by job role, and kept up to date.
7.1A documented, reviewed approach to finding and handling weaknesses.
8.2Turning on and gathering logs from the enterprise's systems.

FINOS AIGF

AIR-PREV-005System Acceptance Testing
AIR-PREV-006Data Quality & Classification/Sensitivity
AIR-PREV-007Legal and Contractual Frameworks for AI Systems
AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
AIR-PREV-012Role-Based Access Control for AI Data
AIR-PREV-014Encryption of AI Data at Rest

7 more

AIR-PREV-017AI Firewall Implementation and Management
AIR-PREV-020MCP Server Security Governance
AIR-PREV-024Human-in-the-Loop Action Approval Gate
AIR-DET-001AI Data Leakage Prevention and Detection
AIR-DET-004AI System Observability
AIR-DET-011Human Feedback Loop for AI Systems
AIR-DET-021Agent Decision Audit and Explainability

ENISA NIS2 guidance

1.1Policy on the security of network and information systems
1.2Roles, responsibilities and authorities
2.1Risk management framework
2.2Compliance monitoring
3.1Incident handling policy
3.2Monitoring and logging

7 more

4.1Business continuity and disaster recovery plan
6.2Secure development life cycle
6.5Security testing
6.10Vulnerability handling and disclosure
9.1Cryptography
11.2Management of access rights
12.4Asset inventory

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.

If you get it wrong

Criminal exposureNo

Criminal exposure note

Article 45's penalties for a violation of Articles 27, 29, or 30 are administrative fines and business restrictions only; a separate, heavier tier in Article 45's third paragraph, for violating the national core data management system specifically, can draw criminal liability, but that tier is not this duty.

Penalty structure

Article 45's first paragraph sets a base tier of a corrective order and a warning, escalating to a fine of 50,000 to 500,000 yuan (10,000 to 100,000 yuan against the directly responsible manager) for a violation of Articles 27, 29, or 30, and a further escalation to 500,000 to 2,000,000 yuan (50,000 to 200,000 yuan against the manager) for refusing to correct the violation or causing a large-scale data leak or other serious consequence. A separate, narrower tier in the same article's second paragraph, for violating the national core data management system specifically, reaches 2,000,000 to 10,000,000 yuan and can draw criminal liability; that tier is not part of this duty and is not the figure this field records.

Rule: Fixed only
As of: 12 September 2026
Currency: CNY
Fixed cap: 2,000,000

Who enforces it

Enforcement body

The competent department exercising data-security supervisory duties over the processor's industry or field.

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

Any organization or individual engaging in a data-processing activity must, under the law and administrative regulations, establish and improve a full-process data-security management system, organize data-security education and training, and take the technical measures and other necessary measures appropriate to keep the data secure.

Where a data-processing activity is conducted using the internet or another information network, this data-security duty applies on top of, not instead of, the network operator's classified-protection duty under the Cybersecurity Law. A processor of important data must designate a person responsible for data security and a managing body, and implement that responsibility.

An ordinary violation draws a corrective order and a warning, escalating to a fine of 50,000 to 500,000 yuan, with a further escalation to 500,000 to 2,000,000 yuan for refusing to correct or causing a large-scale data leak or another serious consequence; a violation of the separate national core data management system carries its own, heavier fine of 2,000,000 to 10,000,000 yuan and can draw criminal liability, but that heavier tier is not this duty.

When LexLint raises it

When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.

Back to the example · Lint your app

Page updated 12 September 2026.