CHINA Trends and Developments Contributed by: Vincent Wang, Xinyao Zhao and Alfred Feng, Global Law Office
Global Law Office 36th Floor, Shanghai One ICC 999 Middle Huaihai Road Xuhui District Shanghai 200031 China Tel: +86 21 2310 8288 Fax: +86 21 2310 8299 Email: vincentwang@glo.com.cn Web: www.glo.com.cn
Data Practice in China in 2025: A Year-End Review 2025 saw noteworthy developments in cross-border data transfer, personal information compliance audit and artificial intelligence (AI), including rules for the certification of cross-border provision of personal information, revision of the Cybersecurity Law, and detailed requirements on AI-generated contents. All these efforts highlight China’s desire to establish a secure and dynamic digital economy that address - es domestic growth needs while keeping an eye on global digital trade. Note that the term data processors, as used in this chapter of the guide, is interchangeable with data controllers as defined by the GDPR, as that term is defined by the Personal Information Protection Law of the PRC (PIPL). Data processors, as defined by the GDPR, are referred to as contracted processors in this chapter. New rules on cybersecurity and data protection Revision of the Cybersecurity Law The Cybersecurity Law of the PRC was revised in 2025 and took effect on 1 January 2026. The revised version explicitly specified that China is willing to sup - port basic theoretical research on AI and research and development of key technologies such as algorithms, which signals that the Chinese government deems emerging technologies and their development activi - ties as critical elements of cybersecurity. In addition, the new Cybersecurity Law significantly increased the face value of penalties for violating companies and responsible individuals, up to CNY10 million for severe compliance issues.
Measures for the Administration of National Cybersecurity Incident Reporting The Measures for the Administration of National Cybersecurity Incident Reporting (the “Measures for Incident Reporting”) were released by the Cyberspace Administration of China (CAC) on 11 September 2025 and came into effect on 1 November 2025. This reg - ulatory instrument makes provision regarding when and how network operators shall report to the relevant authority in case of a cybersecurity incident. Highlights of the Measures for Incident Reporting are as follows: • define standards to determine the severity of cybersecurity incidents, including the duration of impact, the number of people that are involved, the amount of data leaked due to such incidents, and the damage caused by such incidents, etc; • set a clear severity-based time limit for the network operators to report incidents to the authority; • clarify items that should be reported to the author - ity; and • announce the official channel for receipt of security incidents reports. Following the release of the Measures for Incident Reporting, network operators should accordingly update their contingency plans for responding to security incidents in order to ensure compliance with the new regulation. Determination of sensitive personal information Sensitive personal information is subject to stricter protection under the law, but the definition and list
64 CHAMBERS.COM
Powered by FlippingBook