- China’s Network Data Security Regulation (State Council Order 790) took effect on 1 January 2025, turning the Cybersecurity Law, Data Security Law and PIPL into operational, enforceable obligations for every network data processor — including foreign-invested firms.
《网络数据安全管理条例》（国务院令790号）自 2025 年 1 月 1 日起施行，将《网络安全法》《数据安全法》《个人信息保护法》转化为对每一个网络数据处理者（含外资企业）可执行、可处罚的具体义务。- Foreign companies that process personal information of individuals in China must designate a domestic representative or set up a local body and file its details with the city-level Cyberspace Administration (CAC).
处理中国境内自然人个人信息的境外企业，须在中国境内设立专门机构或指定代表，并将其信息报送所在地市级网信部门。- Sensitive personal information — biometrics, health, finance, religious belief, specific identity, whereabouts — requires separate consent, and data on children under 14 needs guardian consent.
生物识别、医疗健康、金融账户、宗教信仰、特定身份、行踪轨迹等敏感个人信息须取得单独同意，不满十四周岁未成年人个人信息须取得监护人同意。- “Important data” handlers must appoint a security manager and team, run risk assessments before sharing or outsourcing, and file an annual risk report to provincial-or-above authorities.
重要数据处理者须明确数据安全负责人与管理机构，在提供、委托、共同处理前开展风险评估，并每年向省级以上主管部门报送风险评估报告。- Cross-border transfers of important data require a CAC security assessment; personal information can exit via assessment, certification, standard contract, or one of several statutory exemptions.
重要数据出境须通过网信部门安全评估；个人信息出境可通过安全评估、保护认证、标准合同或若干法定豁免路径。- Large platforms (50M+ registered users or 10M+ monthly actives) face extra duties: an annual personal-information protection social-responsibility report and stricter cross-border controls.
大型网络平台（注册用户 5000 万以上或月活 1000 万以上）承担额外义务：每年发布个人信息保护社会责任报告，并遵守更严格的数据跨境要求。- Penalties are substantial: routine violations draw fines up to ¥1 million, while national-security-review breaches can reach ¥100 million plus business suspension.
处罚力度显著：一般违规罚款最高 100 万元，违反国家安全审查规定的可处 1000 万元罚款并责令停业整顿。
China’s Network Data Security Regulation: what foreign-invested firms must do | 网络数据安全管理条例：外资企业需要做什么
Overview
On 1 January 2025, the Network Data Security Regulation (网络数据安全管理条例) — State Council Order No. 790, promulgated on 24 September 2024 — came into force. It is the implementing layer beneath three statutes that foreign operators already know by name: the Cybersecurity Law (2017), the Data Security Law (2021) and the Personal Information Protection Law (2021). Where those laws set principles, Order 790 sets procedures, assignees and penalties.
For a foreign-invested enterprise (FIE) running a website, app, SaaS, e-commerce storefront, loyalty programme, HR system or IoT product in China, the Regulation is not background law — it is the rulebook that determines whether your data practices are lawful day to day. This article walks through the obligations that most often catch foreign operators off guard, the cross-border mechanics, and a practical compliance checklist. It is general information, not legal advice.
Who is in scope
The Regulation applies to “network data processing activities” in China — collection, storage, use, processing, transmission, provision, disclosure and deletion of electronic data over a network. If you operate any digital service that touches users or employees in mainland China, you are a network data processor (网络数据处理者) and bear the primary responsibility for the security of the data you handle.
Two extraterritorial hooks matter for foreign parents and platforms:
- Article 26 (mirroring PIPL Article 53): an overseas processor of personal information of individuals in China that is required to establish a local body or designate a representative must file the body’s name (or the representative’s name) and contact details with the city-level Cyberspace Administration. This is the practical foothold CAC uses to reach foreign groups.
- Article 54: China may take necessary measures against overseas organisations or individuals whose network data activities harm national security, public interest, or the personal-information rights of Chinese citizens.
Personal-information obligations
Most foreign businesses handle personal information — customers, leads, employees, newsletter subscribers. The Regulation tightens the rules:
- Transparency. Personal-information processing rules must be集中 displayed, easy to access and prominently placed; sensitive-PI handling, retention periods and the methods for exercising rights must be stated clearly.
- Sensitive PI needs separate consent. Biometrics, religious belief, specific identity, medical/health, financial accounts and whereabouts all require separate consent, not merely bundling into a privacy policy.
- Minors under 14 require guardian consent and a dedicated processing rule.
- Data portability and rights. Users can request access, copy, transfer, correct, delete, restrict processing, cancel accounts and withdraw consent; you must provide convenient channels and not erect unreasonable barriers.
- Compliance audit. Processors must periodically — themselves or via a professional firm — audit their personal-information compliance.
- Scale threshold. A processor of over 10 million individuals’ personal information is pulled into the “important data” duties on security manager, team and annual risk reporting (Articles 28, 30, 32).
Important-data duties
“Important data” is data that, if tampered with, destroyed, leaked or misused, could directly endanger national security, economic operation, social stability or public health and safety. The regime:
- Identification and reporting. Processors must identify and declare important data under national rules; once a region or authority informs or publishes that certain data is important, the handler must fulfil protection duties.
- Security manager + institution. Important-data handlers must designate a data-security负责人 (a management-layer member with direct reporting rights to authorities) and a dedicated management body.
- Risk assessment before sharing. Before providing, entrusting or co-processing important data, a risk assessment is required (statutory duties excepted), covering purpose, necessity, recipient trustworthiness, contract safeguards and technical measures.
- Annual report. Each year, important-data handlers file a risk-assessment report to provincial-or-above authorities, covering processed data, safeguards, incidents and — critically — cross-border transfer circumstances.
Cross-border transfer mechanics
This is where foreign groups feel the pinch. The Regulation preserves the existing three main lawful channels for personal-information export and adds statutory exemptions:
- CAC security assessment — mandatory for important-data exports and for large-volume PI transfers.
- PIPL certification by a professional institution.
- Standard contract filed with CAC.
- Exemptions — necessary to conclude/perform a contract with the individual; cross-border HR management under lawful rules/collective contract; statutory duties; emergencies protecting life/property; and treaty-based routes.
Important data cannot leave China without a CAC security assessment. Even after approval, transfers must not exceed the purpose, scope, type and volume assessed. CAC runs a dedicated cross-border data-security mechanism (Article 34).
Platform and AI-specific duties
If your China operation runs a platform or uses automation, note:
- App-distribution platforms must verify and, where needed, suspend or stop distributing non-compliant applications.
- Personalised recommendation must offer an easy-to-find, easy-to-operate opt-out and let users delete their profile tags.
- Generative-AI providers must secure training data and the training process.
- Large platforms (registered users ≥50M or MAU ≥10M) must publish an annual personal-information protection social-responsibility report and apply stricter cross-border controls; their annual important-data risk reports must also cover key-business and supply-chain data security.
Penalties
Enforcement is graded. Routine breaches (e.g. Articles 12, 22, 40–42) draw warnings, confiscation of unlawful gains, and — if unremedied or serious — fines up to ¥1 million plus possible suspension, rectification, licence revocation, and ¥10,000–¥100,000 personal fines for responsible individuals. National-security-review violations (Article 13) escalate to ¥1 million–¥100 million, suspension/revocation, and ¥100,000–¥1 million personal liability. Mitigation exists for voluntary correction and minor first-time offences.
Practical checklist for foreign firms
- Map your data. Inventory what you collect, where it lives, who touches it, and whether any slice could be “important data” or sensitive PI.
- Appoint ownership. Name a data-security lead (management layer) and a working team; document them.
- Close the extraterritorial gap. If you are an overseas processor of China PI, designate a local representative and file with the city-level CAC.
- Fix consent flows. Separate consent for sensitive PI; guardian consent for under-14s; honour portability and deletion rights with real, low-friction channels.
- Choose a transfer path. For any data leaving China, pick assessment / certification / standard contract / exemption and document the basis; never export important data without CAC approval.
- Run the audits. Periodic PI-compliance audits; annual important-data risk reports where triggered; large-platform reports if thresholds are met.
- Train and record. Keep policies, risk-assessment reports, transfer records and training evidence — penalties hinge on demonstrable diligence.
Sources
- 网络数据安全管理条例（中华人民共和国国务院令 第790号，2024-09-24 公布，2025-01-01 施行），中国政府网：https://www.gov.cn/zhengce/content/202409/content_6977766.htm
- 国务院公报《网络数据安全管理条例》（国令第790号）：https://www.gov.cn/gongbao/2024/issue_11646/202410/content_6980863.html
- 中华人民共和国个人信息保护法（PIPL），全国人大：http://www.npc.gov.cn
- 中华人民共和国数据安全法，全国人大：http://www.npc.gov.cn
Related reading
- 数据出境安全评估与标准合同 / Data export security assessment and standard contract
- 个人信息保护合规审计 / PIPL compliance audit
- 外资企业数据本地化与跨境 / Data localisation for FIEs
网络数据安全管理条例：外资企业需要做什么
概述
2025 年 1 月 1 日，《网络数据安全管理条例》（国务院令790号，2024 年 9 月 24 日公布）正式施行。它是三部法律——2017 年《网络安全法》、2021 年《数据安全法》、2021 年《个人信息保护法》——之下的实施层。三部法律确立原则，790 号条例把它们变成可操作、可处罚的具体程序、责任主体与罚则。
对于在中国运营网站、App、SaaS、电商门店、会员体系、HR 系统或物联网产品的外商投资企业（FIE）而言，本条例不是”背景法”，而是决定你日常数据操作是否合规的实操手册。本文梳理最容易被外资运营方忽略的义务、数据跨境机制与一份合规清单。本文为一般性信息，非法律意见。
谁在范围内
条例适用于中国境内的”网络数据处理活动”——通过网络对电子数据进行收集、存储、使用、加工、传输、提供、公开、删除。只要你在 mainland China 运营任何触达用户或员工的数字服务，你就是网络数据处理者，并对所处理数据的安全承担主体责任。
两条域外效力条款对外国母公司和平台尤为关键：
- 第二十六条（对应个保法第五十三条）：处理中国境内自然人个人信息的境外处理者，如依法须在中国境内设立专门机构或指定代表，应将其名称（或代表姓名）及联系方式报送市级网信部门。这是网信办触达外国集团的实务抓手。
- 第五十四条：对中国国家安全、公共利益或公民个人信息权益造成危害的境外组织、个人，国家网信部门可会同有关部门采取必要措施。
个人信息义务
多数外资企业都处理个人信息——客户、线索、员工、订阅者。条例进一步收紧：
- 透明性。 个人信息处理规则须集中展示、易于访问、置于醒目位置；敏感个人信息处理、保存期限与行权方式须清晰列明。
- 敏感个人信息须单独同意。 生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹均须取得单独同意，不能仅裹挟进隐私政策。
- 不满十四周岁未成年人须取得监护人同意，并制定专门处理规则。
- 可携带权与行权。 用户可请求查阅、复制、转移、更正、删除、限制处理、注销账号、撤回同意；须提供便捷渠道，不得设置不合理障碍。
- 合规审计。 处理者须定期（自行或委托专业机构）审计个人信息合规情况。
- 规模门槛。 处理超过 1000 万人个人信息的处理者，被纳入”重要数据”级别的安全负责人、管理机构与年度风险评估义务（第二十八条、第三十条、第三十二条）。
重要数据义务
“重要数据”指一旦遭篡改、破坏、泄露或非法利用，可能直接危害国家安全、经济运行、社会稳定或公共健康安全的数据。其机制为：
- 识别与申报。 处理者须按国家规定识别、申报重要数据；一旦地区或主管部门告知或公布某类数据为重要数据，处理者须履行保护义务。
- 安全负责人 + 管理机构。 重要数据处理者须指定数据安全负责人（管理层成员，有权直接向主管部门报告）并设立专门管理机构。
- 提供前风险评估。 在提供、委托处理、共同处理重要数据前须开展风险评估（法定职责除外），覆盖目的、必要性、接收方资信、合同保障措施与技术手段。
- 年度报告。 重要数据处理者每年向省级以上主管部门报送风险评估报告，涵盖所处理数据、保障措施、安全事件，以及——关键地——数据出境情况。
数据跨境机制
这是外国集团感受最深的环节。条例保留了个人信息出境的三条主要合法路径并新增法定豁免：
- 网信部门安全评估——重要数据出境及大体量个人信息传输的强制路径。
- 个人信息保护认证（专业机构出具）。
- 标准合同（向网信部门备案）。
- 豁免情形——订立或履行与个人的合同所必需；依法制定的劳动规章制度/集体合同下的跨境人力管理；履行法定职责；紧急情况下保护自然人生命健康和财产安全；以及条约规定的路径。
重要数据未经网信部门安全评估不得出境。即便获批，传输也不得超出评估确定的目的、范围、种类与规模。网信部门建立数据出境安全管理专项工作机制（第三十四条）。
平台与人工智能专项义务
若你的中国业务运营平台或使用自动化，请注意：
- 应用分发平台须核验应用，必要时警示、不予分发、暂停或终止分发不合规应用。
- 个性化推荐须提供易于理解、便于操作的关闭选项，并允许用户删除个人特征标签。
- 生成式人工智能提供者须保障训练数据及训练过程安全。
- 大型网络平台（注册用户 ≥5000 万或月活 ≥1000 万）须每年发布个人信息保护社会责任报告，并施以更严格的跨境管控；其重要数据年度报告还须说明关键业务与供应链数据安全。
法律责任
执法分级。一般违规（如第十二、二十二、四十至四十二条）可处警告、没收违法所得，拒不改正或情节严重的罚款最高 100 万元，并可责令暂停业务、停业整顿、吊销许可，对责任人员处 1 万–10 万元罚款。违反国家安全审查规定（第十三条）可升至 100 万–1000 万元罚款、停业整顿/吊销，并对责任人员处 10 万–100 万元罚款。主动消除危害、轻微并及时改正的，可依法从轻、减轻或不予处罚。
外资企业实操清单
- 梳理数据。 盘点收集内容、存储位置、接触方，以及是否存在”重要数据”或敏感个人信息。
- 落实责任人。 指定管理层级的数据安全负责人与工作队，并形成文件。
- 补齐域外缺口。 若你是处理中国个人信息的境外处理者，指定境内代表并向市级网信部门报备。
- 修正同意流程。 敏感个人信息单独同意；不满十四周岁监护人同意；以真实、低摩擦渠道保障可携带与删除权。
- 选定出境路径。 任何出境数据须选择评估/认证/标准合同/豁免之一并留痕；重要数据未经评估不得出境。
- 开展审计。 定期个人信息合规审计；触发的年度重要数据风险评估；达标的大型平台报告。
- 培训与留证。 保存制度、评估报告、传输记录与培训证据——处罚往往取决于是否展现出可证明的勤勉。
Sources
- 网络数据安全管理条例（中华人民共和国国务院令 第790号，2024-09-24 公布，2025-01-01 施行），中国政府网：https://www.gov.cn/zhengce/content/202409/content_6977766.htm
- 国务院公报《网络数据安全管理条例》（国令第790号）：https://www.gov.cn/gongbao/2024/issue_11646/202410/content_6980863.html
- 中华人民共和国个人信息保护法（PIPL），全国人大：http://www.npc.gov.cn
- 中华人民共和国数据安全法，全国人大：http://www.npc.gov.cn
相关阅读
- 数据出境安全评估与标准合同 / Data export security assessment and standard contract
- 个人信息保护合规审计 / PIPL compliance audit
- 外资企业数据本地化与跨境 / Data localisation for FIEs