CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws Privacy and data protection provisions within the Chi - nese legal framework are scattered across laws and regulations at different legislative levels. In terms of specialised legislation on cybersecurity and data pro - tection, China has established a comprehensive legal framework that includes several key laws and regula - tions – ie, the “Three Fundamental Laws”: • the Cybersecurity Law (CSL; 网络安全法 ); • the Data Security Law (DSL; 数据安全法 ); and • the Personal Information Protection Law (PIPL; 个人 信息保护法 ). These operate together with the “Four Key Regula - tions”: • the Regulations for the Administration of Network Data Security (RANDS; 网络安全数据管理条例 ); • the Security Protection Regulations for Critical Information Infrastructure ( 关键信息基础设施安全保护条 例 ); • the Regulations on the Protection of Minors Online ( 未成年人网络保护条例 ); and • the Regulations on the Graded Protection for Cybersecurity (Draft for Comments) ( 网络安全等级保护 条例 ( 征求意见稿 )). The Three Fundamental Laws and the Four Key Regu - lations form the pillars of China’s cybersecurity and data protection legal framework, with each addressing different aspects of data security and privacy. The CSL was enacted on 1 June 2017 and forms the backbone of cybersecurity and data privacy protec - tion legislation in China. It underwent its first revi - sion in 2025, which took effect on 1 January 2026, achieving co-ordinated integration with the DSL and the PIPL. The DSL came into effect on 1 September 2021 and is the fundamental law in the data security sphere, widely covering data security mechanisms, obligations and liabilities at both state administration and data handler level. The PIPL came into effect on 1 November 2021 and embraces the new era of per - sonal information (PI) protection as well as corporate
data protection compliance. The Four Key Regula - tions further detail the cybersecurity and data protec - tion requirements set forth in the Three Fundamental Laws from different perspectives. In addition to the specialised legislation, China’s gen - eral legislation may also include provisions on privacy and data protection. Specifically, the Civil Code ( 民 法典 ) plays a significant role in this regard. The Civil Code’s provisions relating to data privacy protections are basically consistent with the requirements provid - ed in the Three Fundamental Laws, further solidifying the legal foundation for privacy and data protection in China. Data protection regulations on privacy are also scattered in: • the Criminal Law ( 刑法 ); • the Law on the Protection of Consumer Rights and Interests (Consumer Protection Law; 消费者权益保护 法 ); • the E-commerce Law ( 电子商务法 ); and • Several Issues Concerning the Application of Law in the Trial of Civil Cases Relating to the Use of Facial Recognition Technologies to Process Per - sonal Information ( 最高人民法院关于审理使用人脸识别技术 处理个人信息相关民事案件适用法律若干问题的规定 ), etc. Extraterritorial Reach The PIPL has an extraterritorial effect on overseas PI processing activities, when the processing is for the purpose of providing products or services to, or analysing individuals within, China. The extraterritorial application of the DSL will be triggered where data processing activities conducted outside the territory of China harm its national security, public interests, or the lawful rights and interests of its citizens or organisations. The newly amended CSL expands its extraterritorial application, stipulating that overseas organisations and individuals engaged in activities endangering China’s cybersecurity shall be held legal - ly accountable, and, where serious consequences are caused, measures such as freezing assets or other necessary sanctions may be imposed. Interplay With Other Laws Governing Non- Personal Data, Cyber and AI The interplay between PI protection laws and other laws governing non-personal data, cyber and AI
49 CHAMBERS.COM
Powered by FlippingBook