Chinese Cybersecurity: Questions Remain Despite New Guidance

Despite coming into force on 1 June 2017, China's new Cybersecurity Law (the "Law" or the "Cybersecurity Law") continues to present many unanswered questions.

Although the Cybersecurity Law sets out the basic legal framework for China's enhanced control and protection of cyberspace, there is continued uncertainty regarding key provisions such as Key Information Infrastructures (KIIs) and security assessment provisions.

The Cybersecurity Administration of China has published draft regulations with the aim of alleviating some of the uncertainty. The first such draft, Measures for the Security Assessment of Personal Information and Important Data to be Transmitted Abroad (the "Measures"), was published in April 2017. More recently, on 11 July 2017, the draft Provisions on Protecting Key Information Infrastructures (the "Provisions") were circulated for public consultation. The public consultation ended on 10 August 2017.