Regulations on Network Data Security Management
网络数据安全管理条例, State Council Order No. 790. Adopted at the State Council executive meeting of 30 August 2024, published 24 September 2024, effective 1 January 2025. It is the implementing regulation that ties the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law into one operational rulebook.
In one line
The regulation that turns China's three data pillars into day-to-day obligations: classify your data, secure the processing lifecycle, handle important data and cross-border flows, and take extra care if you are a large network platform.
Who and what it governs
- Applies to network data processing activities in China, covering both personal information and non-personal data.
- Built on the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law and the Civil Code.
What it covers
| Area | Substance |
|---|---|
| General duties | Establish data-security management systems, classify and grade data, appoint responsible staff, keep records, and conduct risk assessments. |
| Personal information | Restates and operationalises PIPL duties: notices, consent, separate consent where required, and handling of sensitive information. |
| Important data | Obligations for processors who handle important data: designate a person responsible, conduct a security assessment, and report risks. |
| Cross-border transfer | Ties into the three routes under PIPL Article 38 and the 2024 cross-border provisions. |
| Large network platforms | Extra duties for platforms with a large user base — a "gatekeeper"-style provision covering third-party products, public-interest obligations and platform rules. |
| Incidents | Reporting and response obligations when an incident occurs. |
| Government handling | Rules on state authorities accessing and processing network data. |
Why it matters
- It converts principles into checklists — the instrument a compliance team actually reads, rather than the statutes themselves.
- The large-platform provisions extend Chinese-style platform responsibility into the data-security field, parallel to the algorithmic recommendation provisions.
Relationship to other instruments
- Parent statutes: Cybersecurity Law (effective 2017-06-01; amended 2025-10-28, in force 2026-01-01, articles renumbered), Data Security Law (effective 2021-09-01), PIPL (effective 2021-11-01).
- Cross-border specifics: PIPL Article 38 and the Provisions on Promoting and Regulating Cross-Border Data Flows (2024-03-22).
- Platform specifics: Algorithmic Recommendation Provisions (2022-03-01).
Unverified / TODO
- Transcribe the article numbers for the classification and important-data duties from the official text
- Confirm the user-scale threshold for the "large network platform" provisions ⚠
- Add the CAC Q&A and official interpretation links [gap:interpretation_missing]
- Check whether the Cybersecurity Law amendment changes any cross-reference here — confirmed: the amendment (adopted 2025-10-28, in force 2026-01-01) renumbered the Cybersecurity Law's articles, so any article-level cross-reference must be read against the re-promulgated text