On 28th May 2019, the Cyberspace Administration of China (CAC)
published on its official website the 'Regulations Governing
Data Security – Discussion Draft' (Draft
Regulations).
The Draft Regulations, following on from existing regulation
such as the Cyber Security Law, look to govern the collection, use,
security and management of personal data (PD) and 'Critical
Data' within China. Key points contained in the Draft
Regulations are:
- The term 'Critical Data' is clearly defined, and
illustrative examples of its meaning are given. Critical Data means
any data which, if disclosed, would likely materially and adversely
impact national security; economic security; social stability;
public health; or public security. Examples given include
non-public government information in respect of demographics,
genetic health, geophysics, mineral resources etc. 'Critical
Data' is defined, generally speaking, as including neither
corporate/commercial information nor PD.
