The PRC Cyber Security Law (the CSL) was enacted in November
2016 and came into force on 1 June 2017. The new law
introduced a raft of measures designed to protect the state and
individuals from cyber-attacks and data theft. These
measures include placing obligations on Critical Information
Infrastructure Operators (CIIs)1 , Network
Operators2 and providers of network products and
services to take active steps to protect computer networks from
cyber-attacks and protect personal information3
and important data from being stolen and/or used for unauthorized
purposes.
Two key features of the CSL are:
- the "data localization" requirement, which requires
CIIs to store within the territory of China any personal
information collected in China; and
