CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
3. Requirements for the Protection and Processing of Non-Personal Data 3.1 Objectives and Scope of Data Regulation With regard to non-personal data protection, China has established a fundamental legal framework cen - tred on the DSL. Furthermore, the Three Fundamental Laws operate synergistically to cover the entire life cycle of data processing. The RANDS, which apply to all network data processing, mark a co-ordinated regulatory framework that unifies privacy, data secu - rity and non-personal data governance under shared obligations. Regarding cross-sector data access and sharing frameworks for IoT, cloud computing or other data processing services, China has not enacted unified legislation for their regulation. Instead, such frame - works are predominantly governed by a combina - tion of data protection laws, sectoral regulations and industry-specific guidelines – ie, the Three Fundamen - tal Laws, as well as certain industrial measures and/ or standards such as: • the Measures on Safety Evaluation for Cloud Com- puting Services ( 云计算服务安全评估办法 ); and • Information Security Technology－Security Technical Requirements of Data Transmission for IoT (GB/T 37025-2018 信息安全技术 — 物联网数据传输安全技术要求 ), etc. China also promotes the secure use and free flow of such data, promotes the availability and accessibility of data and enhances the activity of the data-driven economy, as set out under the Opinions on Building a Basic Data System to Better Play the Role of Data Elements (“Opinions”; 关于构建数据基础制度更好发挥数据要 素作用的意见 ). Under China’s legal framework, all entities process - ing data – whether as IoT service providers (similar to data holders) or as parties that obtain and process data through transactions, licensing or other means (similar to data users) – are subject to statutory obli - gations for data processing. The PIPL and the DSL delineate distinct rights and responsibilities for differ - ent roles, notably data handlers (comparable to data controllers under the GDPR) and entrusted parties
• the People’s Procuratorate; • the consumer organisations specified by law; and • the organisations determined by the CAC. In the past few years, the number of public interest litigation cases regarding PI protection has increased year by year. From July 2015 to September 2025, prosecutors have handled nearly 25,000 cases spe - cifically focused on PI protection. This upward trend reflects the growing frequency of legal actions con - cerning PI protection initiated by prosecutors and shows the great importance attached to PI protection. The core admissibility criteria is that the illegal PI pro - cessing must infringe upon the rights and interests of a large number of individuals, thereby harming the public interest. As stipulated in the Draft Procurato - rial Public Interest Litigation Law ( 检察公益诉讼法 ( 草案 )) released on 28 October 2025, the admissibility of such litigation is also contingent upon preliminary evidence indicating the commission of an unlawful act. Concerning indicative timelines, after a procuratorate places a case on file, it must decide whether to initiate civil public interest litigation within one year. For cases that are major, complex or difficult, this period may be extended. Subsequent litigation stages, including trial and appeal, are generally subject to the time limits prescribed by the Civil Procedure Law ( 民事诉讼法 ). In terms of relief, a court may order the defendant to cease the infringement and assume liabilities such as: • eliminating the adverse effects;
• restoring reputation; • making apology; and • providing compensation.
Furthermore, under the court’s auspices, the procu - ratorate may reach a mediation agreement or a set - tlement with the defendant regarding the enforcement of the judgment.
56 CHAMBERS.COM
Powered by FlippingBook