Meet China CSL security duties with evidence that stays current

The China Cybersecurity Law (CSL) is the People's Republic of China's core statute on network security. Adopted on 7 November 2016 and in force since 1 June 2017, it sets security duties for network operators, extra protections for critical information infrastructure, personal information rules and data localisation for CII operators. It was amended on 28 October 2025, with the changes taking effect on 1 January 2026.

Any organisation that builds, operates, maintains or uses networks within mainland China must comply, because the law treats it as a network operator. That covers network owners, administrators and network service providers. Critical information infrastructure operators in sectors such as energy, finance, transport and public services carry additional duties, and foreign organisations that endanger China's cybersecurity can also face legal liability.

Penalties include warnings, orders to rectify, fines, suspension of business, closure of websites and revocation of licences. Following the 2026 amendments, fines for failing core security duties reach RMB 10 million where the failure causes especially serious harm, such as CII losing its main functions, and up to RMB 1 million for the directly responsible individuals. Lower tiers apply to less serious breaches.

The amendment, adopted on 28 October 2025 and effective 1 January 2026, added provisions on Party leadership and state support for artificial intelligence, significantly raised fines, widened the law's reach over foreign entities, and aligned penalties with the Personal Information Protection Law and Data Security Law. The law now has 81 articles in seven chapters, so many article numbers have shifted by two.

The multi-level protection scheme (MLPS) is the grading system set by Article 23 of the amended law. Network operators must classify their systems by security level and meet matching obligations: internal security policies, a named person responsible for security, anti-malware and intrusion controls, monitoring with network logs kept for at least six months, and data classification, backup and encryption.

Yes, for critical information infrastructure operators. Article 39 of the amended law requires CII operators to store personal information and important data collected and generated in mainland China within China. Where a transfer abroad is genuinely necessary for business, it must pass a security assessment under rules set by the Cyberspace Administration of China and other departments, unless other laws provide otherwise.

The CSL is a legal obligation, while ISO 27001 is a voluntary certifiable standard, but many CSL duties, such as security policies, access control, logging, backup and incident response, map closely to ISO 27001 controls. The CSL sits alongside the Personal Information Protection Law and the Data Security Law, which add detailed rules on personal information and data handling in China.

Yes. OneClickComply supports the China Cybersecurity Law today. It maps the law's security, incident response and personal information duties to controls, collects evidence automatically from your connected tools, generates policies from your real environment and monitors controls continuously. It does not replace local legal advice, MLPS grading or assessments by Chinese authorities, but it keeps your evidence ready for them.