China Data Security Law (DSL / 数据安全法) of 2021

Mechanism

The DSL creates a three-tier data classification system:

1. General data — ordinary data subject to baseline security obligations. 2. Important data (重要数据) — data whose alteration, destruction, leakage, or illegal acquisition or use may endanger national security, economic operations, social stability, or public welfare. Each industry sector's regulator (CAC for internet data, MIIT for industrial data, PBOC for financial data, etc.) must publish its own catalogue defining what constitutes "important data" in that domain. Data handlers in possession of important data face mandatory risk-assessment, risk-monitoring, breach-reporting, and designated-management-personnel obligations. 3. National core data (国家核心数据) — data directly related to national security, the lifelines of the national economy, or key aspects of public interests. Processing national core data requires stricter controls and government oversight; unauthorised disclosure or export carries criminal liability.

Data-export security review (Article 31): Operators of critical information infrastructure (CIIO) and other data handlers dealing with "important data" collected or generated within China must pass a government security assessment before transmitting such data overseas. This provision is the statutory parent of the 2022 CAC Outbound Data Transfer Security Assessment Measures and the 2024 CAC Cross-Border Data Flow Provisions (2024-03-22-cn-cac-cross-border-data-flow-provisions), which operationalise the review thresholds and exemptions.

Blocking statute (Article 36): Chinese organisations and individuals must not provide data stored within China to foreign judicial or law-enforcement authorities without the approval of the competent Chinese authority. This provision forms the legal backbone of China's counter-discovery regime — the mechanism cited in the SEC audit-access standoff with Chinese-listed companies (PCAOB/CSRC 2021-2022 framework) and the extraterritorial friction generated by US court subpoenas directed at data held by Chinese subsidiaries of multinationals.

Data trading and intermediary licensing (Chapter V): Data-trading intermediaries must verify the legality of data sources before facilitating transactions and must not trade data acquired illegally. This lays the statutory groundwork for the Shanghai and Beijing Data Exchanges established in late 2021.

National Data Security Coordination Mechanism (Article 5-8): The CAC leads coordinated data-security work across MIIT, MPS (Ministry of Public Security), MSS (Ministry of State Security), and sector regulators. The coordination mechanism is the institutional architecture that enables multi-regulator enforcement (as seen in the Didi Global cybersecurity review that began within weeks of the DSL's announcement in July 2021).

DSL within the CN data-governance trinity

The DSL is the second of three parent statutes constituting the modern Chinese data-governance legal framework:

• CSL (2016-11-07-cn-cybersecurity-law): Network security, CIIO designation, MLPS, Art. 37 data-localisation for CIIOs — foundational pillar one.
• DSL (this filing): Data classification regime, important-data + national-core-data obligations, data-export review, blocking statute — pillar two.
• PIPL (2021-08-20, queued): Personal-information processing legal bases, cross-border personal-data transfer mechanisms, extraterritorial application, DPIA obligations — pillar three.

All three are operationalised by downstream subsidiary instruments: the 2022 CAC Outbound Data Transfer Security Assessment Measures, the 2022 CAC Standard Contractual Clauses, the 2024 CAC Cross-Border Data Flow Provisions (filed), and sector-specific "important data" catalogues issued by MIIT, PBOC, NHSA, etc.

Downstream implications

• Multinationals with R&D, manufacturing, or platform operations in China must classify whether data generated in their Chinese operations constitutes "important data" under applicable sector catalogues — failure to do so exposes them to enforcement under the DSL risk-assessment obligations.
• The §36 blocking statute creates structural tension with US, EU, and UK e-discovery and regulatory-access frameworks; it is the domestic-law justification PRC entities cite when resisting overseas subpoenas or regulatory document requests.
• The data-export review architecture extends China's data-sovereignty perimeter beyond the CIIO/personal-data footprint of the CSL/PIPL — any entity handling sector-defined "important data" in China (including non-CIIOs and foreign-invested enterprises) is within scope.
• The DSL's national core data category introduces criminal liability thresholds with no clear public catalogue, creating compliance uncertainty for firms in strategic sectors (AI training data, geospatial data, genomics, financial market data, industrial IoT telemetry).

Open questions

• Sector "important data" catalogues remain incomplete: MIIT draft industrial-data catalogue (2022 exposure draft); PBOC financial-data classification guidelines still in consultation as of 2024. Enforcement against foreign firms for uncatalogued data is opaque.
• Interaction with the EU GDPR adequacy decision pathway — the DSL's data-export review regime (requiring government approval for any important data transfer abroad) is difficult to reconcile with GDPR adequacy standards, forestalling any EU-China adequacy decision for the foreseeable future.
• Article 36 blocking-statute scope: courts in the US and EU have generally declined to give Chinese blocking statutes full effect but the growing volume of DSL-related refusals in cross-border litigation creates escalating enforcement friction.