On September 24, 2024, the State Council released the
Regulations on the Management of Network Data Security
(《网络数据安全管理条例》)
("Regulations").1 The Regulations focus on
prominent issues related to Personal Information (PI), Important
Data, and cross-border data transfers. The Regulations provide
further detail and guidance on implementation concerning the
Cybersecurity Law (CSL), Data Security Law (DSL) and Personal
Information Protection Law (PIPL), China's principal laws
governing data security. The Regulations will take effect on
January 1, 2025.
Compared to the draft released for public comment three years
ago,2 the final Regulations relax some compliance
requirements, offering more practical and manageable guidelines for
businesses operating in China. We summarize below the key points of
the Regulations as follows: