China's Cybersecurity Law Imposes New Requirements On Doing Business In China

The Standing Committee of China's National People's Congress (NPC) adopted the country's Cybersecurity Law¹ on November 7—the latest in a spate of national security-related measures targeting the ICT industry. Drafts of the Cybersecurity Law had raised significant concerns in the international business community, due to provisions with the potential to restrict market access such as data localization requirements, national security reviews for ICT products and services, and data retention and sharing requirements. The final draft is largely consistent with previous drafts, although the provisions of the Law are cast broadly, and it will be up to the State Council, Cybersecurity Administration of China, and other government bodies to issue implementing rules in the months and years ahead (in addition to related rules that are already in place). The Cybersecurity Law itself will take effect June 1, 2017.