China – New Data Security Law adopted and will come into force on 1 September 2021

Compared to previous drafts, the final Law introduces stricter requirements in relation to the processing of state critical data (i.e. data related to national security, economic security, important people’s livelihood, or material public interest) and increases the penalties for non-compliance. In addition to steep fines of up to RMB 10 Million, these penalties may include suspensions of operations, revocation of operation permits or business license, sanctions for non-compliant transfer of ‘important data’ outside China and fines imposed on company officials directly responsible for violations.

The Law will have extra-territorial reach, expand data localisation requirements to any organisations processing ‘important data’ (and not only to operators of critical information infrastructure), and impose requirements on entities to obtain authorisation for disclosure of data stored in China in response to requests of foreign judicial or law enforcement agencies.

The Law will enter into force on 1 September 2021.

The NPC’s press release is available here and the Law is available here (both in Chinese only).