The new PRC Encryption Law will come into force on 1 January
2020. It will bring fundamental changes to the sale, import and use
of encryption technologies in China by foreign and domestic
organizations. The changes specifically bring out the
following:
- Broader scope: the new law now
governs encryption products, technologies and services, aligning
more with the PRC Cybersecurity Law. This contrasts with the
previous regulatory focus just on encryption products.
- New encryption classification:
encryption products, technologies and services will now be
categorized into three tiers: “core”,
“ordinary” and “commercial”. The first two
tiers will be used to protect “state secrets”, and so
will be more heavily regulated than the latter (i.e.,
state-monitored security assessments and audits may take place
during the development, implementation and maintenance of such
technologies; and it appears that only local PRC vendors may be
entitled to sell and provide such
