ChinaNetwork Data Security Management Regulation, product vulnerability and incident reporting
Regulation on Network Data Security Management (State Council Order 790), Arts. 9-11
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Reporting, Security
As of .
What it requires
- Applies to a network data processor, meaning an individual or organization that decides for itself the purpose and means of processing network data, for processing in China (Articles 2 and 62); because that reaches almost any organization running a system, this instrument flags on every activity and role this corpus can express.
- Protect network data on the basis of classified cybersecurity protection: keep data security management rules in place and use encryption, backup, access control and security authentication (Article 9).
- On finding a security defect, vulnerability or similar risk in a network product or service you provide, take remedial measures at once, tell users as required and report to the competent department; where national security or the public interest is endangered, also report to the competent department within 24 hours (Article 10).
- Keep an emergency plan for network data security incidents; when an incident occurs, start the plan at once, act to stop the harm spreading and remove the hazard, and report to the competent department as provided (Article 11).
- Where an incident harms the lawful rights and interests of individuals or organizations, promptly tell those affected the incident, the risk, the harm and the remedial steps taken, by phone, text message, instant message, email or public announcement, unless a law or administrative regulation allows non-notification (Article 11).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The competent departments, which pursue a breach of these provisions under the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law (Article 58).
Settledness
- As of
What this law does
A network data processor that finds a security defect, vulnerability or similar risk in a network product or service it provides must take remedial measures at once, tell users as required and report to the competent department. Where the defect or vulnerability endangers national security or the public interest, the processor must also report to the competent department within 24 hours.
When a network data security incident occurs, the processor must start its emergency plan at once, act to stop the harm spreading and report to the competent department as provided. A breach of the provisions of the Regulation that its penalty articles do not list is held to the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law.
When LexLint raises it
When your app profile says your app crawls the web, trains models, generates content with AI, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, publishes adult content, operates a social platform, serves under-18s, operates an app store, ships a mobile app, reuses other publishers' content, distributes a software product, handles health records, provides financial services, runs an essential service, is a listed company, provides telecom services, records calls, records text chat or tracks devices.