Meet China DSL data security obligations with less manual work

The China Data Security Law (DSL) is a national law of the People's Republic of China that regulates the handling and security of all data, in electronic or other form. Adopted by the Standing Committee of the National People's Congress on 10 June 2021 and in force since 1 September 2021, it sets up data classification, risk and incident duties, controls on important data and penalties for breaches.

Any organisation or individual carrying out data handling activities within mainland China must comply with the DSL. That includes Chinese subsidiaries and offices of foreign companies. The law also allows liability to be pursued for data handling outside mainland China that harms China's national security, public interest, or the lawful rights and interests of Chinese citizens or organisations.

Penalties range from warnings and orders to correct up to fines of RMB 10 million. Failing the security duties in Articles 27, 29 and 30 can cost RMB 50,000 to 500,000, rising to RMB 2 million for serious consequences such as large data leaks. Breaching core national data rules or seriously breaching important data export rules can reach RMB 10 million, and individuals can also be fined.

The DSL requires data handlers to establish a data security management system covering the whole data lifecycle, train staff, apply technical and other necessary measures, and monitor risks. They must remediate weaknesses, respond to incidents and notify users and regulators. Important data handlers must also name responsible persons and submit periodic risk assessment reports.

The DSL is one of China's three core data laws, alongside the Cybersecurity Law and the Personal Information Protection Law (PIPL). The Cybersecurity Law covers network security, PIPL covers personal information, and the DSL covers the security of all data, including non-personal and important data. Many organisations in China must comply with all three at once.

Important data is data that regulators list in important data catalogues because its leak or misuse could harm national security, the economy or the public interest. Article 21 sets up the classification and grading system, and core national data receives even stricter controls. Handlers of important data face extra obligations, including periodic risk assessments and rules on exporting it.

Yes, the DSL does not mandate ISO 27001, but an ISO 27001 information security management system covers much of what Article 27 expects, such as security policies, training, technical controls and incident management. Organisations with ISO 27001 can reuse those controls as a strong base, then add DSL specific elements such as data classification and important data handling.

Yes, OneClickComply supports the China Data Security Law today. It maps DSL obligations to controls, collects evidence automatically from your connected tools, monitors for control drift and generates policies with AutoComplete. OneClickComply does not issue certifications or guarantee compliance, but its in-house audit team and Ask an Auditor can guide your approach.