A Review of China’s Cybersecurity and Data Protection Regulatory Framework

The year 2025 represents a decisive phase in the maturation of China’s cybersecurity and data protection regime. A dense series of administrative regulations, implementation measures, technical standards and draft rules were promulgated or brought into force, transforming the core obligations under the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law into operational, auditable and enforcement-ready compliance requirements. Rather than expanding the statutory framework itself, the regulatory focus shifted toward implementation depth, technical standardization and procedural governance, significantly raising the practical compliance threshold for enterprises.

 Key Regulatory Developments in 2025

	Systematization of network and data security governance

The Regulations on the Administration of Network Data Security, which came into effect on 1 January 2025, constitute the cornerstone of China’s operational data governance framework. The regulation integrates the core obligations under the Cybersecurity Law, the Data Security Law and the Personal Information Protection Law into enforceable management mechanisms, including mandatory data classification and grading, allocation of data security responsibilities, annual security risk assessments, and clearer rules on extraterritorial applicability and liability attribution.

On 8 March 2025, the Cybersecurity Bureau of the Ministry of Public Security  issued the Notice on Further Improving the Classified Cybersecurity Protection Regime, reinforcing upgrading requirements for the Multi-Level Protection Scheme (MLPS) and tightening technical and management controls for critical information infrastructure and important systems. Together, these measures signal a shift toward lifecycle-based and system-level compliance.

	Strengthening of personal information protection and auditability

The Measures for the Administration of Personal Information Protection Compliance Audits were promulgated and became effective on 1 May 2025. These Measures require personal information processors to establish auditable compliance systems, conduct regular internal audits, retain audit evidence, and ensure accountability mechanisms are embedded into daily operations, thereby transforming compliance from policy-based documentation into evidence-driven governance.

On 18 July 2025, the Cyberspace Administration of China (CAC) issued the Announcement on Carrying Out the Reporting of Responsible Persons for Personal Information Protection,  institutionalizing accountability by requiring designated responsible officers to be registered and subject to regulatory supervision, especially for large-scale processors.

	Scenario-based regulation of biometric and sensitive technologies

On 21 March 2025, the Measures for the Administration of the Security of Facial Recognition Technology Applications were released and took effect on 1 June 2025. The Measures introduce strict necessity assessments, alternative solution requirements, impact assessments and proportionality controls, significantly raising the compliance threshold for biometric processing scenarios.

Earlier, on 14 March 2025, the CAC released the Measures for the Identification of Artificial Intelligence-Generated Synthetic Content, together with the national standard GB 45438-2025 Cybersecurity Technology - Labeling Requirements for Artificial Intelligence–Generated Synthetic Content. These rules require a combination of explicit labeling and technical traceability mechanisms to enhance authenticity verification and accountability across the content lifecycle.

	Standardization of digital identity and public infrastructure

On 23 May 2025, the Administrative Measures on National Network Identity Authentication Public Services were issued and entered into force on 15 July 2025. The Measures promote the public-service orientation of digital identity infrastructure, strengthening interoperability, security accountability and regulatory oversight over identity authentication services.

	Refinement of cross-border data governance mechanisms

On 13 June 2025, regulators released the draft Guidelines on the Security of Automotive Data Cross-Border Transfers (2025 Edition) for public consultation, providing operational guidance for multinational automotive and smart mobility enterprises facing dual regulatory pressure from data localization and global supply chain integration.

On 17 October 2025, the Measures for the Certification of Personal Information Outbound Transfers were promulgated and took effect on 1 January 2026, completing the core compliance pathways for lawful cross-border personal data transfers.

	Normalization of incident reporting and enforcement mechanisms

On 15 September 2025, the Measures for the Administration of Cybersecurity Incident Reporting were released and took effect on 1 November 2025. These Measures standardize incident classification, reporting timelines, internal escalation procedures and remediation coordination mechanisms.

On 27 June 2025, the CAC issued the Provisions on the Application of Administrative Penalty Benchmarks by Cyberspace Administration Authorities, strengthening predictability of penalties while simultaneously increasing the importance of compliance evidence quality and internal control maturity in enforcement outcomes.

	Risk assessment, de-identification and proceduralized supervision

Between November and December 2025, regulators successively released draft rules for public consultation, including:

1)	the Guidelines on the Identification/De-identification/Anonymization of Personal Information (released on 24 November 2025), 
2)	the Measures on Public Security Authorities’ Supervision and Inspection of Cybersecurity (released on 29 November 2025), and 
3)	the Measures for Network Data Security Risk Assessment (released on 6 December 2025). 

These drafts signal an accelerated move toward engineering-driven supervision based on standardized technical benchmarks and procedural enforcement.

 Compliance Implications for Enterprises

	Compliance architecture and evidence-based governance

Companies are moving away from policy- and checklist-based compliance. Regulators now focus on whether technical controls work in daily operations, records are auditable, and processes are repeatable. Compliance is shown through system logs, documentation, audit trails, risk reports, and workflows that withstand inspection.

For large platforms and data-intensive businesses, expectations are higher. Regulators expect formal governance structures, dedicated compliance or data protection teams, defined responsibilities, and regular reporting lines. Large platforms increasingly operate like regulated infrastructure, with closer oversight and limited tolerance for informal management.

	Technology risk and operational resilience

Technologies such as facial recognition and generative AI face tighter scrutiny. Companies must justify necessity, assess risks, and implement labeling or traceability where required. Technical design choices directly affect compliance risk, requiring close coordination across legal, product, engineering, and security teams.

Risk management is becoming operational. Regular risk reviews, incident response plans, escalation procedures, and follow-up actions are no longer optional. Regulators expect preparedness before incidents, organized response during incidents, and traceable records afterward.

	Enforcement and cross-border complexity

Enforcement is becoming more consistent and evidence-driven. Companies should expect more inspections and deeper reviews of internal controls and documentation. Informal or reactive compliance approaches are increasingly unsustainable.

For multinational companies, cross-border data management is more complex. Data export assessments, certifications, and localization must be built into system design and business planning early. Data governance now shapes cloud strategy, supply chains, and global operating models, making data compliance a core business issue.

 Comment

China’s 2025 cybersecurity and data protection rules show a clear move away from broad principles toward very practical, hands-on regulation. The focus is now on concrete processes, technical standards, and clear accountability. In the short term, this will increase costs and operational pressure, especially for platform companies and businesses that move data across borders. Over time, however, clearer rules and more consistent enforcement should make risks easier to manage and planning more predictable. A stronger compliance foundation should also improve overall data security and trust in the digital economy.