| Legislation in force: |
Implementation Rules for Security Certification of Network Critical Equipment and Network Security Special Products
- Critical Network Equipment and Specialised Security Products (First Batch)
- From 9 June 2017
- (mainly) issued by Cyberspace Administration of China (CAC)
- In scope: equipment with potentially affects China’s national security.
- These implementation rules specifies network products that must be certified before they can be sold in China.
- An additional sales licence may be required.
In China, the Cybersecurity Law (CSL), the Data Security Law (DSL) and the Personal Information Protection Law (PIPL) are the most important for data protection. The basis for all data protection measures from the above laws is the Multi-Level Protection Scheme (MLPS 2.0 = CCPS 2.0), which obliges all companies registered in China to have their IT systems security certified by the local authorities.
Overview of laws:
(1) China’s "Personal Information Protection Law" (PIPL) is the equivalent to the EU’s "General Data Protection Regulation" (GDPR).
PIPL:
- protects personal information rights and interests,
- standardizes personal information handling activities, and
- promotes the rational use of personal information.
- the transfer of personal data outside of China is also addressed.
PIPL relates to China's “Cybersecurity Law” (CSL) and China's “Data Security Law” (DSL).
(2) China’s Cybersecurity Law (CSL) is purposed to strengthen the national security.
Most important for the assessment of device cybersecurity is certainly the CSL.
CSL:
- defines security obligations of internet services,
- refines rules with respect to personal information protection,
- defines rules for “network operators” and operators of “critical information infrastructure”.
(3) China’s Data Security Law (DSL) covers the creation, use, storage, transfer, and exploitation of data within China.
DSL:
- requires prior the export of certain data a "cybersecurity review".
- Note: the "cybersecurity review" is still under development.
(4) Other industry sectors or certain types of data may have their dedicated regulation, e.g. Automotive Data Security Management Provisions.
|