Data Security Law (DSL)
数据安全法. Effective 1 September 2021. The middle pillar: it treats data as a national-security asset and requires classification, not just protection of personal information.
In one line
Data in China has to be classified and graded: the more it matters to national security, the more controls, up to a state security review before it may leave the country.
Who and what it governs
- Applies to data processing activities in China, covering both electronic and non-electronic data.
- Excludes state secrets, which are handled separately.
Main obligations
| Area | Substance |
|---|---|
| Classification and grading | Establish a data classification and grading system; apply higher protection to higher grades. |
| Important data | Identify important data, appoint a responsible person, conduct risk assessments, and report risks to the authorities. |
| National security review | Data activities that affect or may affect national security are subject to a security review. |
| Export controls | Export of important data and of data by CII operators is subject to the cross-border regime (PIPL Article 38 and the 2024 provisions). |
| Processing duties | Lawful and proper collection, no unlawful acquisition, and security measures across the lifecycle. |
| Government use | Rules on state authorities collecting and using data, including restrictions on using data for purposes beyond the statutory one. |
| Legal liability | Corrective orders, warnings, fines, suspension of business, revocation of licences, and personal liability. |
Why it matters
- It is the legal basis for the important data concept that drives cross-border assessment obligations.
- It makes data security a matter of national security, not only individual rights — the key conceptual contrast with the GDPR.
Relationship to other instruments
- Sits with the Cybersecurity Law and PIPL as the "three pillars".
- Implemented by the Regulations on Network Data Security Management (effective 2025-01-01).
Unverified / TODO
- Add the direct permalink to the DSL text on the national law database — NPC Observatory: http://www.npc.gov.cn/npc/c2/c30834/202106/t20210610_311888.html
- Transcribe the article numbers for classification, important data and the security review
- Note the sectoral important-data catalogues where published ⚠
- Detail the liability articles and amounts