ChinaData Security Law, Risk Monitoring and Incident Reporting Duty
Data Security Law of the People's Republic of China, Art. 29
In force since .
A vulnerability and incident reporting rule binding private bodies.
- Obligation class
- Security, Reporting
What it requires
- This binds the same data processor as this jurisdiction's Data Security Law data-security-program duty; it adds a risk-monitoring and incident-response duty rather than reaching a different party.
- Strengthen risk monitoring of your data-processing activity, and on discovering a data-security defect, vulnerability, or other risk, immediately take remedial measures.NIST CSF 2.0DE.CM-09NIST CSF 2.0ID.RA-06
- On an actual data-security incident, immediately take disposal measures, promptly notify affected users as provided, and report the incident to the competent authority; the statute states no numeric deadline, only immediacy and promptness.NIST CSF 2.0RS.MI-01NIST CSF 2.0RS.CO-02
- A processor of important data carries an additional, periodic risk-assessment-and-reporting duty under Article 30 tied to the important-data classification rather than to any activity in this vocabulary, so it is not flagged as its own instrument.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
- PR.PO-P10A vulnerability management plan is developed and implemented.
- NIST CSF 2.0
- ID.RA-06Risk responses are chosen, prioritized, planned, tracked, and communicated
- DE.CM-09Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events
- RS.CO-02Internal and external stakeholders are notified of incidents
- RS.MI-01Incidents are contained
- CIS Controls
- 3.10Encryption of sensitive data as it crosses networks.
- 3.11Encryption of sensitive data where it is stored on servers and applications.
- 6.8Access rights defined by job role, and kept up to date.
- 7.1A documented, reviewed approach to finding and handling weaknesses.
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
3 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Criminal exposure note
Article 45's penalties for a violation of Articles 27, 29, or 30 are administrative fines and business restrictions only; the separate, heavier national-core-data tier of Article 45 that can draw criminal liability is not this duty.
Penalty structure
Article 45 punishes a failure to perform the duties of Articles 27, 29, and 30 together, without a separate penalty clause for Article 29 alone: a base tier of a corrective order and a warning, escalating to a fine of 50,000 to 500,000 yuan (10,000 to 100,000 yuan against the directly responsible manager), and a further escalation to 500,000 to 2,000,000 yuan (50,000 to 200,000 yuan against the manager) for refusing to correct the violation or causing a large-scale data leak or other serious consequence. The separate national-core-data tier, up to 2,000,000 to 10,000,000 yuan with possible criminal liability, is not part of this duty.
- Rule
- Fixed only
- As of
- Currency
- CNY
- Fixed cap
- 2,000,000
Who enforces it
Enforcement body
The competent department exercising data-security supervisory duties over the processor's industry or field.
What this law does
Any organization or individual engaging in a data-processing activity must strengthen risk monitoring and, on discovering a data-security defect, vulnerability, or other risk, immediately take remedial measures. On an actual data-security incident, the organization or individual must immediately take disposal measures, promptly notify affected users as provided, and report the incident to the competent authority.
The statute sets no numeric deadline for that notice or report, only immediacy and promptness; the National Cybersecurity Incident Reporting Measures set an operative reporting clock for such an incident, but bind by a network-operator classification recorded in the jurisdiction summary rather than raised as an instrument here.
The penalties for a violation are the same tiered fines as this jurisdiction's Data Security Law data-security-program row, since Article 45 punishes a failure under Articles 27, 29, and 30 together.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, provides cloud services, provides a general-purpose AI model, is a frontier developer, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .