Most compliance mistakes in China come from applying the wrong one of three overlapping laws to a system, a dataset or a transfer. The Cybersecurity Law (CSL), the Data Security Law (DSL) and the Personal Information Protection Law (PIPL) each govern a different object: networks, all data, and personal information. They share definitions, regulators and enforcement, and the Network Data Security Management Regulations (State Council Decree No. 790) now sit across all three. This guide compares them side by side: what each one protects, who it binds, which regulator acts, how transfers and incidents are handled, and how penalties stack, with worked scenarios showing which law answers which question. It is for security, privacy and legal leads at multinationals with operations, users or data in mainland China.
Status line: checked on 14 November 2026 against the official CSL amendment decision (adopted 28 October 2025, in force 1 January 2026), the DSL (in force 1 September 2021), the PIPL (in force 1 November 2021), Decree No. 790 (in force 1 January 2025) and the March 2024 cross-border Provisions. English texts are unofficial translations; the Chinese text controls.
Key takeaways
- Different objects, one stack: the CSL protects networks and their operation, the DSL protects all data graded by its importance to the state, and the PIPL protects individuals' rights over their personal information. Most real systems trigger all three at once.
- Decree No. 790 is the glue: Article 1 says it implements all three laws, and it supplies the operational duties (incident handling, important data officers, annual assessments) that the laws state only as principles.
- Penalties moved between laws in 2026: the amended CSL Article 71 sends personal information violations and CII data export breaches to other laws, so PIPL and DSL penalty articles now carry most data enforcement.
- Three different export tests: the CSL localises CII data, the DSL controls important data exports and foreign judicial requests, and the PIPL sets the consent and route rules; the March 2024 Provisions set the thresholds that apply to both personal information and important data.
- Individuals are exposed under every law: each law fines directly responsible managers, from RMB 10,000 up to RMB 1 million, and the PIPL can bar them from senior or protection officer roles.
The short answer: which law applies
Ask three questions about any system or data flow. Does it involve operating or using a network in mainland China? The CSL applies. Does it involve handling any data, and could any of it be important or core data? The DSL applies. Does it involve information that identifies a living person, or offshore handling aimed at people in China? The PIPL applies. The answers are not exclusive. The useful question is therefore not "which law" but "which law sets the binding duty for this decision". The table below answers that per topic.
| Question | Cybersecurity Law | Data Security Law | PIPL |
|---|---|---|---|
| What it protects | Networks, network operation and network information security | All data, in electronic or other form, graded as core, important or general | Rights of natural persons over their personal information |
| In force | 1 June 2017; first amendment in force 1 January 2026 | 1 September 2021 | 1 November 2021 |
| Main duty holders | Network operators (owners, managers and service providers of a network); CII operators; network product and service providers | Any organisation or individual handling data; important data handlers carry extra duties | Personal information handlers and entrusted parties; overseas handlers aiming at people in China |
| Territorial reach | Networks in mainland China; overseas actors endangering China's cybersecurity (amended Art. 77) | Data handling in mainland China; offshore handling harming China's national security or public interest (Art. 2) | Handling in mainland China; offshore handling to provide goods or services to, or analyse, people in China (Art. 3) |
| Regulators | CAC coordinates; telecoms authority, public security and others within their remits (Art. 8) | Sector regulators (industry, telecoms, transport, finance and others), public and state security; CAC coordinates online data security (Art. 6) | CAC coordinates; State Council departments and local authorities within their scope (Art. 60) |
| Core control system | Multi-level protection scheme (MLPS), CII protection, product certification | Data classification and grading, important data catalogues, risk assessments | Legal bases, notice and separate consent, impact assessments, individual rights |
| Data export rule | CII operators store personal information and important data in China; exports need a security assessment (2016 Art. 37) | Important data exports under CAC measures (Art. 31); no data to foreign courts or police without approval (Art. 36) | Security assessment, certification or standard contract (Art. 38); separate consent; CIIO and threshold localisation (Art. 40) |
| Top entity fine | RMB 2 million to 10 million for especially serious consequences (amended Art. 61) | RMB 2 million to 10 million for core state data violations (Art. 45); RMB 1 million to 10 million for serious export breaches (Art. 46) | Up to RMB 50 million or 5% of prior year turnover (Art. 66) |
Cybersecurity Law: the network layer
What it guards against: attacks, intrusions and failures that disrupt networks, especially infrastructure whose loss could endanger national security or the public interest. Its model is that whoever owns, manages or provides a network is responsible for keeping it secure and lawful.
Architecture in words: every network operator meets the MLPS duties (2016 Art. 21): named responsible persons, technical measures against viruses and intrusion, monitoring and logging with network logs kept for at least six months, data classification, backup of important data and encryption. Operators identified as CII by their sector protection department add a security management body, background checks, annual assessments, procurement security review and localisation of personal information and important data. Product and service suppliers meet mandatory standards, and the 2025 amendment adds a dedicated penalty (new Art. 63) for selling critical network equipment or security products without certification or testing.
Incident timing: the CAC's National Cybersecurity Incident Reporting Measures, in force since 1 November 2025, require CII operators to report no later than one hour after an incident, central and state organs within two hours, and other network operators to their provincial CAC within four hours. Incidents are graded in four levels using a classification guide based on GB/T 20986-2023. See the China Cybersecurity Incident Reporting Measures Guide.
Failure modes: treating the CSL as a privacy law (the 2026 amendment moves personal information penalties elsewhere); assuming CII status needs a numeric threshold, when it is a notification by the sector protection department; short log retention on cloud services hosting China workloads; and incident playbooks built around a 72 hour clock that cannot meet a one or four hour report.
Controls that evidence compliance: MLPS grading and testing records, log retention configuration showing six months or more, an incident runbook with the provincial CAC route, and procurement records for certified network equipment. See the China MLPS 2.0 Guide and the China Cybersecurity Law Guide.
Data Security Law and Decree No. 790: the data layer
What it guards against: harm to national security, the economy and public interest from data being altered, destroyed, leaked or illegally obtained, whether or not any individual is identifiable. Industrial telemetry, geographic data, supply chain records and aggregated statistics are all in scope.
Architecture in words: DSL Article 21 sets a categorised and tiered system. A national coordination mechanism plans important data catalogues, regions and sectors identify important data in their domains, and core state data (national security, lifelines of the economy, key livelihood issues, major public interests) gets a stricter regime. All handlers build whole-process data security management, training and technical measures, and network processing follows MLPS (Art. 27). Important data handlers name responsible persons and a management body (Art. 27) and submit periodic risk assessment reports (Art. 30). Decree No. 790 makes these concrete: a data security lead from senior management who can report directly to regulators (Art. 30), a risk assessment before providing, entrusting or jointly processing important data (Art. 31), and an annual risk assessment report to a provincial-level or higher authority (Art. 33). Article 62 defines important data by field, group, region, precision or scale.
The trigger problem: important data depends on designation. Decree No. 790 Article 37 and Article 2 of the March 2024 Provisions both say that data not notified by an authority or published as important does not need a security assessment as important data. Once a catalogue or notice covers it, the export route changes. See the Data Classification Guide.
Failure modes: classifying only personal information and ignoring operational datasets; responding to a foreign court order, regulator or eDiscovery request from China-stored data without approval, which DSL Article 36 forbids and Article 48 fines at up to RMB 5 million in serious cases; and missing the Decree No. 790 Article 28 rule that handlers of personal information of more than 10 million people take on important data handler duties under Articles 30 and 32 even with no designated important data.
Controls that evidence compliance: a data inventory graded core, important and general, a register of applicable sector catalogues, the annual assessment report, pre-sharing risk assessments, and a legal review gate on all foreign data requests. See the China Data Security Law and Network Data Security Regulations Guide.
PIPL: the personal information layer
What it guards against: misuse of personal information against the individual, from excessive collection and opaque profiling to transfers abroad without the person's knowledge. It is rights-based. For the European comparison see GDPR vs PIPL.
Architecture in words: Article 13 gives seven legal bases, with consent unnecessary for the six non-consent grounds such as contract necessity, lawful HR management and statutory duties. There is no general legitimate interests basis. Separate consent applies to sharing with another handler, public disclosure, sensitive personal information and outbound transfers where consent is the basis. Handlers above CAC thresholds appoint a personal information protection officer (Art. 52); overseas handlers caught by Article 3 set up a dedicated entity or representative in China (Art. 53). Cross-border transfers use one of the Article 38 mechanisms: a CAC security assessment, certification or a standard contract, with CIIOs and handlers above CAC volume thresholds localising data and needing a security assessment to export (Art. 40). Compliance audits are covered in the China Personal Information Protection Compliance Audits guide.
Failure modes: relying on a global privacy notice for separate consent; counting transfer volumes per system rather than cumulatively since 1 January; ignoring Article 3 because the organisation has no China entity; and assuming the HR exemption covers every use of employee data abroad.
Controls that evidence compliance: a lawful basis register per purpose, separate consent records, personal information protection impact assessments, transfer route filings, the Article 53 representative filing and audit reports. See the China PIPL Guide.
Cross-border transfers: how the three rules combine
Transfers are where the laws interlock most tightly. The March 2024 Provisions on Promoting and Regulating Cross-Border Data Flows (CAC Order No. 16, in force on publication, 22 March 2024) prevail over the 2022 security assessment measures and the 2023 standard contract measures where they conflict (Art. 13). They set one decision path covering both personal information and important data.
| Flow | Which law drives the duty | Route under the 2024 Provisions |
|---|---|---|
| Trade, logistics, manufacturing or academic data with no personal information or important data | None for export | Exempt (Art. 3) |
| Personal information necessary for a contract with the individual, cross-border HR or emergencies | PIPL | Exempt from all three mechanisms (Art. 5(1) to (3)); notice and consent rules still apply |
| Non-CIIO, fewer than 100,000 individuals (non-sensitive) since 1 January | PIPL | Exempt (Art. 5(4)) |
| Non-CIIO, 100,000 to under 1 million individuals, or sensitive data of under 10,000 | PIPL | Standard contract or certification (Art. 8) |
| Non-CIIO, over 1 million individuals, or sensitive data of over 10,000 | PIPL | CAC security assessment (Art. 7) |
| Any processor exporting designated important data | DSL (Art. 31) and Decree No. 790 (Art. 37) | CAC security assessment (Art. 7); never exempt |
| CII operator exporting personal information or important data | CSL localisation, PIPL Art. 40 | CAC security assessment (Art. 7) |
| Request from a foreign court, regulator or police for China-stored data | DSL Art. 36 (and PIPL for personal information) | Approval of the competent Chinese authority before any provision |
The operational detail of filings, free trade zone negative lists and group filings is in China Cross-Border Data Transfers.
Penalties and how they stack
Since 1 January 2026 the three laws divide enforcement more cleanly. The amended CSL Article 71 states that infringing personal information rights and CII exports in breach of Article 39 are handled under other laws, and new Article 73 allows mitigation under the Administrative Penalty Law. One incident can still produce penalties under more than one law where different duties failed.
| Law and article | Breach | Entity | Responsible individuals |
|---|---|---|---|
| CSL Art. 61 (network operator) | MLPS or incident duties | RMB 10,000 to 50,000; 50,000 to 500,000 on refusal or harm | RMB 10,000 to 100,000 |
| CSL Art. 61 (CII operator) | CII duties | RMB 50,000 to 100,000; 100,000 to 1 million on refusal or harm | RMB 10,000 to 100,000 |
| CSL Art. 61 (consequences) | Serious, such as large-scale leaks; especially serious, such as CII losing main functions | RMB 500,000 to 2 million; RMB 2 million to 10 million | RMB 50,000 to 200,000; 200,000 to 1 million |
| DSL Art. 45 | Security duties (Arts. 27, 29, 30) | RMB 50,000 to 500,000; 500,000 to 2 million if serious; 2 million to 10 million for core data | RMB 10,000 to 100,000; 50,000 to 200,000 if serious |
| DSL Art. 46 | Important data export in breach of Art. 31 | RMB 100,000 to 1 million; 1 million to 10 million if serious | RMB 10,000 to 100,000; 100,000 to 1 million |
| DSL Art. 48 | Providing data to foreign justice or police without approval | RMB 100,000 to 1 million; 1 million to 5 million if serious | RMB 10,000 to 50,000; 50,000 to 500,000 |
| Decree No. 790 Art. 57 | Important data handler duties (Arts. 30, 31, 32 and others) | RMB 50,000 to 500,000; 500,000 to 2 million if uncorrected or mass leakage | RMB 10,000 to 100,000; 50,000 to 200,000 |
| PIPL Art. 66 | General; serious | Up to RMB 1 million on refusal to correct; serious: up to RMB 50 million or 5% of prior year turnover | RMB 10,000 to 100,000; serious: 100,000 to 1 million and role bans |
Worked scenarios
Scenario 1, a manufacturing telemetry platform: a foreign manufacturer streams machine sensor data from Chinese plants to a global analytics cloud. No individuals are identified. The PIPL does not apply. The CSL applies to the plant networks (MLPS, logging, incident reporting within four hours as an ordinary network operator). The decisive law is the DSL: the company must grade the data and check the industrial sector's important data catalogue. If nothing is designated, Article 3 of the 2024 Provisions exempts the export; if the sector regulator notifies that production data at certain precision is important, a security assessment is needed before export continues and Decree No. 790 duties (data security lead, annual report) begin.
Scenario 2, an e-commerce app run from Singapore: the company has no entity in China but sells to Chinese consumers. PIPL Article 3 applies, so it needs an Article 53 representative, a lawful basis per purpose and separate consent for transfers. The CSL does not bind it as a network operator in China, though Article 77 reaches overseas activity endangering China's cybersecurity. The DSL reaches offshore handling only where it harms China's national security or public interests.
Scenario 3, a ransomware incident at a bank's Chinese subsidiary: if the bank is notified CII, the CSL reporting clock is one hour to the protection department and public security. Customer data exposure engages PIPL notification and remediation duties, and Decree No. 790 Article 11 requires the emergency plan, reporting to the competent authority and notice to affected people by phone, SMS, email or public announcement. If the attacker exfiltrated designated important data, DSL Article 45 penalties for failed security duties may follow.
Trade-offs and decision guidance
- One programme or three: small organisations with only a sales office in China usually run one integrated China data programme owned by privacy, because PIPL duties dominate. Large groups with plants, R&D or CII status need separate owners: security for CSL and MLPS, data governance for DSL grading and catalogues, privacy for PIPL.
- Localise or transfer: keeping data in China removes the transfer route problem but not the DSL foreign request rule or MLPS. Transferring needs the route analysis per flow. CII operators have little choice: localisation is the default.
- Grade conservatively or wait for catalogues: waiting relies on Article 37 of Decree No. 790; grading conservatively costs effort but avoids a sudden halt when a sector catalogue is published.
Where identity fits
Each law counts machine activity. Service accounts, API keys and integration tokens that pull China-resident data into global systems are transfer channels under the PIPL thresholds and potential important data exports under the DSL. Restricted access is an explicit security duty in the PIPL and part of MLPS under the CSL. Keep an inventory of which non-human identities can read China-resident data, where their calls terminate and how many distinct individuals they touch per year, so transfer counts are evidence rather than estimates. See the China AI Agent Rules Guide for agent-specific rules.
Detection and measurement
- Coverage: percentage of China-hosted systems with an MLPS grade and a named responsible person.
- Classification: percentage of datasets graded core, important or general, and number checked against current sector catalogues in the last quarter.
- Transfer counting: cumulative individuals exported per flow since 1 January, against the 100,000, 1 million and 10,000 sensitive thresholds.
- Incident timing: time from detection to regulator report in exercises, against the one, two or four hour limit that applies.
Framework mapping
| Obligation area | Law | NIST CSF 2.0 | ISO/IEC 27001:2022 Annex A |
|---|---|---|---|
| Data inventory, classification and grading | DSL Art. 21, 27; Decree No. 790 Art. 29 | ID.AM | A.5.9, A.5.12 |
| Legal and regulatory requirements register | All three | GV.OC | A.5.31 |
| Privacy and personal information protection | PIPL | GV.OC, PR.DS | A.5.34 |
| Logging and monitoring | CSL 2016 Art. 21 | DE.CM | A.8.15, A.8.16 |
| Incident reporting | CSL reporting measures; Decree No. 790 Art. 11 | RS.CO | A.5.24, A.5.26 |
| Information transfer | PIPL Art. 38; DSL Art. 31, 36 | PR.DS | A.5.14 |
Practitioner checklist
- Build one register mapping each China system and dataset to the CSL, DSL and PIPL duties it triggers.
- Confirm CII status in writing and track any change notification.
- Set network log retention for China workloads to at least six months.
- Grade data core, important or general and review sector catalogues quarterly.
- Appoint the Decree No. 790 data security lead where important data or the 10 million threshold applies.
- Run a transfer route analysis per flow and refresh counts monthly.
- Write a China incident annex with the one, two and four hour routes and notice templates.
- Update the penalty map to the 2026 CSL, DSL, Decree No. 790 and PIPL articles.
- Gate eDiscovery and regulator requests with Chinese legal review.
Standards and references
- Cyberspace Administration of China: NPC Standing Committee Decision on Amending the Cybersecurity Law
- Stanford DigiChina: Cybersecurity Law of the People's Republic of China (translation)
- China Law Translate: Data Security Law of the People's Republic of China (translation)
- Stanford DigiChina: Personal Information Protection Law (translation)
- State Council: Regulations on Network Data Security Management (Decree No. 790)
- Cyberspace Administration of China: Provisions on Promoting and Regulating Cross-Border Data Flows
- Cyberspace Administration of China: National Cybersecurity Incident Reporting Measures
Related NHI Mgmt Group resources: China Cybersecurity Law Guide, China Data Security Law and Network Data Security Regulations Guide, China PIPL Guide, China Cross-Border Data Transfers, Global Privacy Regulatory Map. This guide summarises the PRC Cybersecurity Law, Data Security Law and Personal Information Protection Law and is not legal advice.