Treat China as a perimeter, not an exception
A multinational security team cannot handle China as a local variation on its global standard. The regime regulates the network, the data and the incident separately, and each part has consequences that a global operating model does not anticipate. Four decisions matter most: whether each China entity is in scope for the heavier obligations, how data is classified, which mechanism governs data leaving China, and whether the incident path can meet China’s reporting clocks.
This article covers each decision. It is a briefing for security leadership, not legal advice. Applicability turns on entity type, sector and data volumes, so local counsel should confirm the conclusions for your business.
The architecture of the regime
Three laws sit at the core. The Cybersecurity Law covers network operators, critical information infrastructure and graded system protection. The Data Security Law covers data classification and “important data”. The Personal Information Protection Law covers personal information. A growing set of implementing rules does the practical work, including cross-border transfer provisions, personal information audit measures and national incident reporting measures.
The Cybersecurity Law has also changed. The amended law is now in force, and four changes matter to security teams:
• Higher fines. For critical information infrastructure operators, the maximum fine for general violations rose from RMB 1 million to RMB 10 million. For other operators it rose from RMB 100,000 to RMB 2 million. First-time violators can now be fined as well.
• Wider reach. The law now applies to overseas activity that harms China’s cybersecurity, not only activity that harms critical information infrastructure inside China.
• Credit for remediation. Penalties can be reduced where a violator remedies harm, voluntarily discloses unknown violations or cooperates with an investigation, and waived for first-time, minor violations corrected promptly. Remediation records and cooperation now have a direct bearing on outcomes.
• A general AI clause. The law commits the state to stronger AI risk monitoring and safety oversight. It creates no AI-specific control requirement yet, but further regulation is likely.
Decision one: is each China entity in scope?
Most obligations attach to the network operator, a broad category that covers anyone who owns or runs a network or provides services over it in mainland China. A subsidiary running a website, an application or an internal network there will usually qualify. Two further classifications raise the stakes.
Graded system protection. Under the Multi-Level Protection Scheme, operators grade each system on a five-level scale according to the harm a compromise would cause. Level 2 and above are filed with public security authorities. Level 3 and above require testing by a qualified evaluation body and are subject to recurring inspection. Grading is self-assessed, which makes the grading decision itself a point of regulatory exposure.
Critical information infrastructure. Operators designated as critical information infrastructure carry the heaviest obligations and face the highest fines. Designation is made by the authorities. A multinational’s China entity is more likely to be caught if it operates in a regulated sector such as finance, telecommunications, energy or transport.
Decision two: classify data before moving it
Cross-border transfer rules depend on what the data is and how much of it moves. The thresholds below are the baseline. The rules also contain exemptions, so read the table as a starting point for analysis.
| Mechanism | When it is required (baseline thresholds) |
|---|---|
| Security assessment by the Cyberspace Administration of China | Critical information infrastructure operators transferring personal information or important data. Other operators transferring important data, personal information of more than 1 million individuals, or sensitive personal information of more than 10,000 individuals. |
| Standard contract or certification | Operators that are not critical information infrastructure operators transferring personal information of more than 100,000 but fewer than 1 million individuals, or sensitive personal information of fewer than 10,000 individuals. |
| Exempt from all three | Transfers necessary to conclude or perform a contract with the individual. Employee data transferred for cross-border HR management. Emergency transfers to protect life or property. Non-sensitive personal information of fewer than 100,000 individuals. Data not on a free trade zone’s negative list, where the handler is registered there. Trade and cross-border logistics data that contains no personal information or important data. |
Two points deserve attention. First, the exemptions matter for multinationals because HR data and contract-performance flows are common, and many are exempt. Record which exemption you rely on and why. Second, under the transfer provisions, data is not treated as important data unless the authorities notify the handler or publicly designate it. That reduces classification paralysis, but it does not remove the duty to check whether your sector’s regulator has published a catalog.
Separately, the personal information audit measures require organizations processing the personal information of more than 10 million individuals to audit compliance at least every two years, and those processing more than 1 million to name a person responsible. Authorities can order a professional audit after an incident affecting more than 1 million individuals’ personal information or more than 100,000 individuals’ sensitive personal information.
Decision three: can the incident path meet China’s clocks?
The national incident reporting measures are the sharpest operational difference from most global programs. Incidents are graded in four tiers, and reporting is mandatory for the top three. Examples of triggers include a leak of personal information of more than 1 million individuals, direct economic loss above RMB 5 million, a full outage of critical information infrastructure lasting more than 30 minutes, and theft or leakage of important data that threatens national security or social stability.
| Who reports | To whom | Deadline |
|---|---|---|
| Network operator | Provincial cyberspace authority | Within 4 hours of identifying a qualifying incident |
| Critical information infrastructure operator | Sector protection authority and public security authority | Within 1 hour |
| Operator, once the incident is resolved | Authorities, in a post-incident report covering cause, response, damage, accountability and rectification | Within 30 days of resolution |
| Service providers | The network operator | Promptly. Operators must require this by contract. |
Where the full facts are not yet known, operators can report the basic information and impact first and supplement later. Financial institutions face a separate set of People’s Bank of China rules with a one-hour initial report.
Consider how a typical global response works. A follow-the-sun SOC detects, a regional hub triages, group legal reviews, and a decision comes back to the local entity. Against a four-hour clock, and certainly a one-hour clock, that chain fails. The China entity needs pre-delegated authority to make the report, a named local contact, pre-approved templates and a vendor contract that forces fast notice.
Operating models: the trade-offs
| Model | How it works | Trade-off |
|---|---|---|
| Global model with China overlay | One identity, tooling and data estate. China-specific controls are layered on. | Lowest cost and the simplest to run. The most cross-border data flows to justify, and the hardest incident path to localize. |
| Ring-fenced China perimeter | Local tenants, identity and data stores. A local escalation path feeds the global SOC. | Cuts reliance on transfer mechanisms and fits the incident clocks. Costs more and fragments tooling and visibility. |
| Hybrid | Ring-fence the data classes that trigger thresholds. Integrate the rest. | Balances cost and compliance. Requires disciplined data classification to keep the boundary honest. |
Our reading is that the hybrid model suits most multinationals, because it concentrates cost where regulatory exposure concentrates. Your choice will depend on data volumes, sector, designation status and tolerance for operating friction. It is a judgment to test with local counsel, not a rule.
What security leadership can do now
1. Determine whether each China entity is a network operator, a critical information infrastructure operator or a large personal-information processor, and document the basis for the conclusion.
2. Map the data flows leaving China. For each one, record the mechanism or exemption relied on.
3. Rehearse the four-hour and one-hour incident path with the China entity’s authority, templates and contacts in place.
4. Amend supplier and managed-service contracts so that providers notify promptly and support regulatory reporting.
5. Keep a record of grading decisions, remediation steps and cooperation with authorities. The amended penalty rules reward it.
6. Assign an accountable executive and a review cadence. The regime is still moving, and a regional advisor cannot own that for you.
| **** |
|---|
Sources
1. DLA Piper, China: Amendments to Cybersecurity Law — privacymatters.dlapiper.com
2. Mondaq, China Releases Final Measures on Cybersecurity Incident Reporting — mondaq.com
3. Linklaters, China: the world’s strictest one-hour cybersecurity incident reporting regime — techinsights.linklaters.com
4. Jones Day, China Finalizes Provisions on Cross-Border Data Transfer — jonesday.com
5. China Briefing, China’s Personal Information Protection Audit Final Measures — china-briefing.com
6. PwC Germany, IT security in China is evolving — pwc.de
7. App in China, What is China’s MLPS Filing and Who Needs One? — appinchina.co
How we label evidence
Facts carry a source. Analysis and recommendations are marked as ours. Examples that are hypothetical are labeled as hypothetical.
Part of the solutionSecure & ComplyTurn regulatory duties into controls that hold up.See how we work →Related service
Regulatory Compliance
Use this to translate regulatory requirements into security priorities.