On 28 October 2025, the Standing Committee of the National
People's Congress adopted a set of amendments to the
Cybersecurity Law (CSL), which will take effect on 1 January 2026.
These amendments recalibrate data and cybersecurity compliance
obligations and significantly increase penalties, creating a more
structured, stringent, and closely supervised regulatory
environment for companies operating within China's digital
landscape.
Enhanced Penalty Regime for Non-Compliance
This marks the first significant revision since the CSL entered
into force in 2017. Together with the Personal Information
Protection Law (PIPL) and the Data Security Law (DSL), the CSL
forms the cornerstone of China's national data and
cybersecurity framework. A key focus of the amendments is
recalibrating and tiering (distinguishing critical information
infrastructure, CII, operators from those that are not) the penalty
provisions and strengthening compliance obligations. Most notably,
