Security Laws, Regulations and Standards
Security Laws, Regulations and Standards is where NISP Level 2 becomes distinctly Chinese: you must assign an obligation to the right statute and know the mandatory thresholds. Questions typically give a business scenario and ask which law governs.
The statutory core
- Cybersecurity Law (网络安全法, effective 2017-06-01) - MLPS obligations, log retention of at least six months, real-name registration, critical information infrastructure (CII) protection, incident response duties.
- Data Security Law (数据安全法, effective 2021-09-01) - data classification and grading, important-data catalogues, security assessment for outbound transfer of important data, national data security review.
- Personal Information Protection Law (个人信息保护法, effective 2021-11-01) - lawful basis and informed consent, separate consent for sensitive personal information, sharing with third parties and public disclosure; individual rights to access, correct and delete; personal information protection impact assessments; breach notification; serious violations can attract fines up to RMB 50 million or 5% of prior-year turnover.
- Cryptography Law (密码法, effective 2020-01-01) - core, common and commercial cryptography; CII operators must use commercial cryptography and pass an application security assessment (密评).
- Regulations on CII Security Protection (2021-09-01) and GB/T 22239-2019 define the graded-protection control set.
Cross-border transfer
Outbound personal information requires one of the statutory paths - security assessment, certification, or a filed standard contract - plus separate consent and notice of the overseas recipient. Important data follows the Data Security Law assessment route instead.
Worked example
A subsidiary wants to send employee HR records to its overseas headquarters. Which rules apply? The data is personal information, so PIPL governs: a lawful basis, separate consent for any sensitive items, notice of purpose and recipient, and one of the three transfer mechanisms. If the dataset is also designated important data, the Data Security Law assessment applies as well. If the volume crosses the regulator's threshold, the security assessment path becomes mandatory rather than optional. Reasoning: identify the data category first, then the statute, then the mechanism.
Traps
- Mixing up Cybersecurity Law, Data Security Law and PIPL responsibilities.
- Assuming ordinary consent covers sensitive data or cross-border transfer.
- Believing anonymised data still falls inside PIPL - it does not, but pseudonymised data does.
- Forgetting the six-month log-retention rule.
- Ignoring sector standards (GB/T 35273 on personal information, GB/T 22239 on graded protection).