Meet China DNSIP personal information duties with confidence

DNSIP is China's Decision on Strengthening Network Information Protection, adopted by the Standing Committee of the National People's Congress on 28 December 2012. Its 12 articles protect electronic information that can identify citizens or involves their privacy. It requires lawful, legitimate and necessary collection with consent, published collection rules, confidentiality, technical security measures and deletion of infringing information on request.

Network service providers and other enterprises and public institutions that collect or use citizens' personal electronic information during business activities must comply. Providers of network access, telephone and information publishing services also have real-name registration and content management duties, and any organisation or individual sending commercial electronic messages must obtain the recipient's agreement first.

Article 11 allows warnings, fines, confiscation of unlawful income, cancellation of permits or filings, website closure and bans on responsible personnel working in network services. Violations are recorded in social credit files and published. Serious cases can lead to public security penalties or criminal liability, and organisations that infringe others' rights bear civil liability. The Decision does not set specific fine amounts.

Yes, as a foundation of China's personal information rules, but later laws built on it. The Cybersecurity Law and the Personal Information Protection Law now set far more detailed rules on personal information. Organisations usually address DNSIP alongside those laws, since its principles of consent, transparency, confidentiality and security are carried forward and expanded in them.

Comply by collecting personal electronic information only lawfully and with consent, publishing your collection and use rules, keeping the data confidential and applying technical security measures. You also need a process to take remedial action after leaks, to delete infringing information when individuals ask, to manage unlawful user content and to obtain consent before sending commercial electronic messages.

DNSIP shares core principles with GDPR, such as lawful and necessary collection, consent, transparency and security, although GDPR is far more detailed. ISO 27001 does not cover DNSIP specifically, but its information security controls help evidence the technical measures Article 4 requires. Mapping all three to one control set lets evidence count towards each.

Yes. OneClickComply supports China DNSIP today, mapping its 12 articles to controls shared with other frameworks. Automated evidence collection, continuous monitoring and AutoComplete policies help you show that personal electronic information is protected. OneClickComply helps you prepare and maintain evidence but does not certify or guarantee legal compliance, so take local legal advice where needed.