Chinese Cybersecurity Law: Duties, CIIOs, and Penalties

China’s Cybersecurity Law, in force since June 1, 2017 and significantly amended in October 2025, sets the rules for anyone operating a computer network in mainland China. It requires network operators to classify and secure their systems, verify user identities, log activity, report incidents, and, for operators of critical infrastructure, keep certain data inside the country. The 2025 amendments raised fines sharply, added tiers for serious harm, and extended the law’s reach to some conduct occurring outside China.

Whether the law applies to your business, and how heavily, depends almost entirely on one question: are you an ordinary network operator, or have regulators designated you a critical information infrastructure operator?

Who the Law Applies To

The statute uses the term “network operator” broadly. It covers network owners, network administrators, and anyone providing services through a network.¹ In practice that means internet service providers, e-commerce platforms, app developers, website operators, and companies running internal IT systems, regardless of industry. If your business runs anything on a network in mainland China, assume you are a network operator.

A smaller group carries much heavier duties: critical information infrastructure operators, or CIIOs. The law names public communications, information services, energy, transportation, water management, finance, public services, and e-government as covered sectors, and lets regulators add others.² CIIO status is not self-declared. Industry regulators apply their own criteria and formally notify the operators they designate. Once you receive that notice, the CIIO-specific rules described below apply.

Baseline Duties for Every Network Operator

Every operator, not just CIIOs, must meet a core set of obligations built around China’s Multi-Level Protection Scheme.

MLPS Classification

The MLPS classifies every non-personal network into one of five levels based on the network’s scope, the data it handles, and the damage a breach would cause.³ Level one is the least sensitive; level five is reserved for systems whose failure would severely threaten national security. Most commercial businesses fall into level two or three, which require access controls, intrusion detection, and data encryption. At level three and above, operators must use domestically developed components in core systems and submit encryption algorithms for government review.

Real-Name Verification

Operators providing internet access, phone service, domain registration, information publishing, or instant messaging must verify each user’s real identity before providing service. Users who refuse cannot be given access.² Verification is typically done through government-issued identification or a verified mobile phone number.

Logging, Incident Response, and Government Assistance

Operators must monitor and record network activity and keep those logs for at least six months. Every operator needs an emergency response plan, and any breach must be reported to authorities as soon as it is detected. Operators must also provide technical support and assistance to public security and national security organs conducting lawful investigations.² The statute does not define the scope of that assistance, which leaves authorities wide latitude in what they can request.

Vulnerability Reporting

Under the Provisions on the Management of Network Product Security Vulnerabilities issued in 2021, a company that discovers a vulnerability in its own products or services must report it to the Ministry of Industry and Information Technology within two days. Disclosing the vulnerability to overseas entities is prohibited.

Additional Obligations for CIIOs

CIIOs carry the baseline duties plus a heavier compliance layer. Staff in sensitive positions must pass security background checks conducted with the involvement of public security and national security agencies.⁴ Hardware and software in critical systems must meet state-approved security standards, which often means buying from vendors that have passed government review.

Each CIIO must set up a dedicated internal security management body, run periodic risk assessments, and share the results with regulators. Incidents must be reported promptly to both the Cyberspace Administration of China and public security organs.⁴ Regulators treat late reporting as its own compliance failure.

Data Localization and Cross-Border Transfers

CIIOs that collect or generate personal information or important data during operations in mainland China must store that data inside China.² The rule covers both physical servers and cloud infrastructure, and remote access from a foreign parent does not sidestep it.

When a genuine business need requires sending data abroad, the transfer must pass a formal security assessment under procedures set by the Cyberspace Administration of China and other agencies.² The assessment weighs the sensitivity of the data, the risks of the transfer, and the protections available at the receiving end.

Thresholds for a Mandatory CAC Assessment

A mandatory CAC security assessment applies when:

A CIIO transfers any personal information overseas.
Any data controller transfers “important data” overseas.
Non-sensitive personal information of more than one million individuals is sent abroad in a calendar year.
Sensitive personal information of more than 10,000 individuals is sent abroad in a calendar year.

Transfers below those thresholds may qualify for lighter routes, such as filing standard contractual clauses or obtaining a protection certification from a licensed institution.

How the Law Interacts with China’s Other Data Statutes

Two later statutes sit alongside the Cybersecurity Law: the Data Security Law, effective September 1, 2021, and the Personal Information Protection Law (PIPL), effective November 1, 2021. The Cybersecurity Law regulates network security itself. The Data Security Law classifies datasets as “important data” or “core data” and restricts their handling on national-security grounds. PIPL governs the collection, processing, storage, and transfer of personal information. Complying with one does not excuse non-compliance with another; a single cross-border data transfer can trigger duties under all three.

Penalties After the 2025 Amendments

The 2025 amendments overhauled the penalty structure. Fines now scale based on who violated the law and how serious the fallout was.

Ordinary Network Operators

A first violation draws an order to correct and a warning, with a possible fine of 10,000 to 50,000 RMB. If the operator refuses to fix the problem or the failure causes actual cybersecurity harm, the company fine rises to 50,000 to 500,000 RMB, and directly responsible individuals face personal fines of 10,000 to 100,000 RMB.⁵

CIIOs

A first warning for a CIIO can carry a fine of 50,000 to 100,000 RMB. Refusal to correct, or actual cybersecurity harm, raises the company fine to 100,000 to 1,000,000 RMB, with individual fines of 10,000 to 100,000 RMB for responsible managers.⁵

Escalation for Serious and Especially Serious Consequences

The amendments added a tier that did not exist before. Where a violation by either type of operator causes serious harm, such as a large-scale data leak or partial loss of critical infrastructure functions, fines reach 500,000 to 2,000,000 RMB for the company and 50,000 to 200,000 RMB for responsible individuals. For especially serious consequences, such as a critical system losing its primary functions, fines climb to 2,000,000 to 10,000,000 RMB for the company and 200,000 to 1,000,000 RMB for individuals.⁵ At this tier regulators can also suspend business operations, shut down websites and apps, and revoke operating licenses.

A separate track of penalties applies where operators fail to stop prohibited content or refuse takedown orders, reaching 2,000,000 RMB and rising to 10,000,000 RMB with license revocation for especially serious impact.⁵ Where national security is threatened, criminal charges against senior executives remain possible.

Reach Outside China

The original 2017 law covered network construction, operation, and maintenance inside mainland China. The 2025 amendments extended enforcement to conduct occurring outside China that endangers Chinese cybersecurity and causes serious domestic consequences. Available measures include freezing assets and imposing other sanctions. Foreign companies and individuals whose offshore activity is deemed to harm Chinese network security now face at least the theoretical risk of enforcement, even without a physical presence in the country. PIPL already claimed similar extraterritorial jurisdiction over the processing of personal information belonging to individuals in China; the amended Cybersecurity Law carries the same principle into network security more broadly. For multinationals, cybersecurity decisions taken at overseas headquarters can now produce regulatory consequences in China when they affect Chinese networks or data.

1
China Law Translate. 2016 Cybersecurity Law
2
DigiChina. Cybersecurity Law of the People’s Republic of China
3
Trade Commissioner Service. Chinas Cybersecurity and Cross-Border Data Transfer Regimes
4
DigiChina. After 5 Years, Chinas Cybersecurity Rules for Critical Infrastructure Come Into Focus
5
China Law Translate. Cybersecurity Law of the People’s Republic of China (2026 Revised Version)