- China mandates a data classification and grading (数据分类分级) baseline; the national standard GB/T 43697-2024 took effect on 1 October 2024.
中国确立了数据分类分级基线制度，国家标准GB/T 43697-2024于2024年10月1日施行。- The Network Data Security Management Regulations (State Council Order No. 790, effective 1 January 2025) require handlers to classify and grade network data and identify important data.
《网络数据安全管理条例》（国务院令790号，2025年1月1日施行）要求处理者对网络数据分类分级并识别重要数据。- Data is graded into core, important and general; important data triggers catalogue reporting and stricter export control.
数据分为核心、重要、一般三级；重要数据触发目录报送与更严格的出境管控。- A critical information infrastructure operator (CIIO) owes extra duties: a security assessment, a person in charge, and annual risk assessment.
关键信息基础设施运营者承担额外义务：安全评估、安全负责人与年度风险评估。- The 2026 financial-information sector guide shows the model: three primary classes, four grades, and a 67-item third-level list.
2026年金融信息服务数据分类分级指南给出范本：3个一级类、4级、67项三级分类。- Cross-border data flows are gated by grade: important data needs a security assessment; unidentified data generally does not.
数据出境按级别设闸：重要数据须安全评估，未被认定为重要数据的通常无需申报。
Data Classification, Grading and Critical Information Infrastructure Obligations for Foreign-Invested Enterprises | 外资企业的数据分类分级与关键信息基础设施义务
The Baseline: Classify and Grade
China’s data-governance stack is built on one foundational duty: data classification and grading (数据分类分级). The Data Security Law (2021) created the system; the Cybersecurity Law, the PIPL and the Network Data Security Management Regulations (State Council Order No. 790, effective 1 January 2025) give it teeth. The national standard GB/T 43697-2024, Data Security Technology — Rules for Data Classification and Grading, released on 21 March 2024 and effective 1 October 2024, is the general rulebook that industry regulators and handlers follow.
How Grading Works
Under GB/T 43697-2024, data is graded by its importance to economic and social development and the harm that leakage, tampering, destruction or unlawful use would cause. The framework has three tiers:
- Core data: covers areas or groups with high coverage or precision/scale/depth, whose unlawful use could directly affect political security—e.g. data on national security key areas, the national economic lifeline, major public welfare or major public interest.
- Important data: specific fields, groups or regions, or data of a certain precision and scale, whose alteration or leakage could directly endanger national security, economic operation, social stability, public health or safety.
- General data: everything else, further sub-divided by handlers as needed (often 2–4 internal levels).
Key principles: scientific and practical, clear boundaries, grade up where in doubt (就高从严), point-and-area combined, and dynamic updating.
What “Important Data” Actually Means for an FIE
Important-data identification is the practical flashpoint. The 2026 CAC guidance on the financial-information sector illustrates the live model: data is classified by business attribute into three primary classes (business, user, enterprise), then sub-divided into nine secondary and 67 tertiary classes; it is graded into core, important, sensitive-general and routine-general. Handlers follow a defined flow—data inventory, classification, grading, a graded catalogue, important-data directory reporting, and dynamic updating.
For an ordinary FIE, the safe reading is: you are expected to run a data inventory and apply the grading rules yourself, and to report important data to the competent department once identified. Under the Provisions on Promoting and Regulating Cross-Border Data Flows, data not notified or published as important by a department or region does not require a security assessment—but the action obligation to classify and identify is not waived.
Critical Information Infrastructure (CII) Duties
If a handler is designated a critical information infrastructure operator (CIIO), the obligations rise sharply:
- a security assessment before commencing operations and on material change;
- a person in charge of network security and a dedicated management body;
- an annual risk-assessment report on network data processing;
- stricter rules on data location and on cross-border transfer of personal information and important data, which generally requires a CAC security assessment.
CIIO status is determined by the relevant industry regulator; an FIE in telecom, finance, energy, healthcare, transport or cloud/services with national-scale reach should assume it may be in scope.
The Network Data Security Management Regulations in Practice
State Council Order No. 790 operationalises the above: it sets the classify-and-grade duty, the important-data catalogue and reporting obligation, the CIIO security assessment and person-in-charge requirements, and the dedicated duties of large platform providers (e.g. an easy-to-find option to turn off personalised recommendation, and an annual personal-information protection social-responsibility report for the largest platforms). It also optimises the cross-border mechanism: a handler may export personal information where it meets the conditions, and data not notified as important need not be assessed as such.
Why This Matters for Cross-Border Flows
Classification and grading is the gate to every export route. The chain is: inventory → classify → grade → identify important data → if important, security assessment before export; if general and within the standard-contract or certification bands, the lighter routes apply; if a CIIO, assessment is the default. An FIE that has not graded its data cannot know which route it needs, and mis-grading important data as general is a direct violation.
Practical Steps for a Foreign-Invested Enterprise
- Inventory the data you hold in China by business scene and entity.
- Apply GB/T 43697-2024 to classify (by industry/business attribute) and grade (core/important/general).
- Identify and report important data to the competent department; keep the catalogue dynamic.
- Check CIIO status with your industry regulator; if in scope, build the assessment, person-in-charge and annual-report files.
- Map each data stream to its export route before any transfer; do not move data you have not graded.
Related Reading
See our cross-border data transfer rules (No. 35), the field-level data export negative list (No. 57) and the amended Cybersecurity Law in force from 2026 (No. 178).
外资企业的数据分类分级与关键信息基础设施义务
基线：分类与分级
中国数据治理体系的基石是一项基础义务——数据分类分级。2021年《数据安全法》建立了制度；《网络安全法》《个人信息保护法》与《网络数据安全管理条例》（国务院令790号，2025年1月1日施行）赋予其执行力。国家标准GB/T 43697-2024《数据安全技术 数据分类分级规则》于2024年3月21日发布、2024年10月1日施行，是行业主管部门与数据处理者遵循的通用规则。
分级如何运作
根据GB/T 43697-2024，数据依其在经济社会发展中的重要程度，以及遭篡改、破坏、泄露或非法使用所造成的危害进行分级，框架分三级：
- 核心数据：对领域、群体、区域具有较高覆盖度或达到较高精度、较大规模、一定深度，非法使用可能直接影响政治安全——如国家安全重点领域、国民经济命脉、重大民生、重大公共利益相关数据。
- 重要数据：特定领域、特定群体、特定区域或达到一定精度规模，遭篡改或泄露可能直接危害国家安全、经济运行、社会稳定、公共健康与安全的数据。
- 一般数据：其余数据，由处理者按需再细分（通常2—4级）。
基本原则：科学实用、边界清晰、就高从严、点面结合、动态更新。
“重要数据”对外资企业的实际含义
重要数据识别是实务焦点。网信办2026年金融信息服务领域指南给出了鲜活范本：数据按业务属性分为业务、用户、企业3个一级类，再细分9个二级、67个三级类；按核心、重要、敏感一般、常规一般分为4级。处理者按既定流程作业——数据梳理、分类、分级、形成分级清单、报送重要数据目录、动态更新。
对普通外资企业，稳妥理解是：应自行开展数据盘点并套用分级规则，并在识别到重要数据后向主管部门报送。依据《促进和规范数据跨境流动规定》，未被相关部门、地区告知或公开发布为重要数据的，无需作为重要数据申报安全评估——但分类分级与识别的”作为”义务并不因此免除。
关键信息基础设施（CII）义务
若被认定为关键信息基础设施运营者（CIIO），义务显著加重：
- 运营前及重大变更前开展安全评估；
- 设置网络安全负责人与专门管理机构；
- 每年提交网络数据处理风险评估报告；
- 数据与系统的存放及个人信息、重要数据出境受到更严约束，通常须通过网信部门安全评估。
CIIO身份由相关行业主管部门认定；在电信、金融、能源、医疗、交通或云/服务领域具有全国规模的外资企业，应假定自己可能落入范围。
《网络数据安全管理条例》的落地
国务院令790号将上述要求落地：确立分类分级义务、重要数据目录与报送义务、CIIO安全评估与负责人要求，以及大型平台企业的专有责任（如提供易于查找的个性化推荐关闭选项、最大平台每年发布个人信息保护社会责任报告）。同时优化了跨境机制：处理者符合条件即可出境个人信息；未被通知为重要数据的，无需作为重要数据申报评估。
为何这关系到跨境流动
分类分级是每条出境路径的闸门。链条为：盘点→分类→分级→识别重要数据→若为重要数据，出境前安全评估；若为一般数据且落在标准合同或认证区间，走较轻路径；若为CIIO，评估为默认。未分级的外资企业无从判断该走哪条路；把重要数据误判为一般数据，属直接违规。
外资企业的实操步骤
- 盘点数据：按业务场景与主体梳理在华持有的数据。
- 套用GB/T 43697-2024：按行业/业务属性分类，按核心/重要/一般分级。
- 识别并报送重要数据给主管部门；目录保持动态更新。
- 核实CIIO身份：与行业主管部门确认；若落入范围，建立评估、负责人与年度报告档案。
- 每条数据流映射至出境路径后再传输；未分级的数据不要动。
延伸阅读
可参阅本站跨境数据传输规则（编号35）、字段级数据出境负面清单（编号57）与2026年施行的修订《网络安全法》（编号178）。
Sources