Cybersecurity Law and Data Security Law of the People's Republic of China

The PIPL is only one leg of China's data regime, and for many businesses it is not the binding one. The Cybersecurity Law imposes security, real-name registration, incident-reporting and cooperation duties on 'network operators' — a definition broad enough in practice to reach almost any business that owns or administers its own network in mainland China — and imposes markedly heavier obligations on operators of critical information infrastructure, including annual security evaluations, procurement security reviews for products affecting national security, and domestic storage of personal information and important data. The Data Security Law adds a classification-and-grading regime across ALL data, not just personal data, with the heaviest duties attaching to 'important data' and to data with a bearing on national security, plus a rule against providing data stored in China to foreign judicial or law-enforcement authorities without Chinese approval. Marked 'check': sectoral 'important data' catalogues are issued by individual regulators and the CII identification rules are set sector by sector, so whether either regime binds a given business is a fact-specific question this atlas cannot answer.