About:
China’s new Cybersecurity Law came into effect on June 2017, it is regarded as a milestone for China’s cybersecurity legislation as it assimilates many of the pre-existing rules and regulations and combines them into a structured law. The law is not only about internet security, it also includes computer security, communication security, automation, and control system security.
The law roughly divides companies into two categories:
Network operators, these are all companies using a network, almost every company does this, so network operator will apply to the majority of companies.
Critical Information Infrastructure Operators (CII Operators): So far, no clear guideline or definition regarding it exists yet. CII is information infrastructure that would cause serious consequences if it suffers damages, function loss or data leakage. Enterprises defined as CII operators must of course comply with more stringent requirements.
How does the law affect businesses?
Currently the biggest concerns for companies are VPN compliance and data security compliance.
VPN compliance: This is not a new problem, but so far, VPN laws weren’t that clear and haven’t been enforced strictly thus companies often simply ignored them. But now authorities ordered a “VPN clean-up” and multinational cooperation had to pay more attention to this problem. In the future, companies will be able to use VPN’s (for internal work purposes) but they need to purchase services from licensed suppliers and also file for a VPN usage record.
Data security compliance: The law pays more attention to individual privacy and the protection of personal information, companies will have to focus more on protecting these in the future. There are now also restrictions on transfer of information outside China, from now on, sensitive data will have to be stored inside the country and can’t simply be transferred outside.
Read more about the law on China Briefing or China Law Blog.
