When China’s Cybersecurity Law took effect on 1 June 2017, consumers and businesses, financial institutions among them, faced tighter rules on how personal data was created and used. The law had been enacted by the Standing Committee of the National People’s Congress on 7 November 2016, after a third deliberation.
Law firm DLA Piper commented in 2017 through partner Scott Thiel and Of Counsel Carolyn Bigg. They said the law targeted online fraud and was meant to protect China against internet security risks.
Why the law came
The government saw the internet as important and also as a real source of threat. The law was its response, and it combined security and data protection duties in one statute.
DLA Piper described three main effects. The law set new security and data protection obligations for “network operators”. It restricted transfers of data out of China by “key information infrastructure operators”. It also introduced new restrictions on critical network and cybersecurity products.
What the law required
The most closely watched provision concerned operators of key information infrastructure. Personal data and “important data” that they collected or produced during operations in China had to be kept inside the country.
Data could leave only after a security assessment. That assessment followed measures to be set jointly by the national cyberspace authority and the State Council. The exception was where another PRC law allowed the overseas transfer.
Wider obligations followed for network operators. Bigg said the law brought enhanced security duties, data breach monitoring and notification requirements, and additional rights for data subjects. She called it a significant strengthening of China’s data protection and security compliance environment.
Financial institutions: less new, with one catch
Bigg noted that localisation was not new for regulated sectors. Banks supervised by the China Banking Regulatory Commission already had to keep customers’ personal financial information inside the PRC. They were already subject to data breach notification requirements.
She therefore expected the practical impact on financial services to be smaller than on unregulated businesses. The catch concerned regulated firms that counted as key information infrastructure operators. For them, localisation would now cover “important data” as well as customers’ personal data.
Her advice to compliance teams at banks and insurers was to understand the new rules. They also needed to update their China compliance programmes before 1 June 2017.
What happened next
On 28 October 2025, the Standing Committee of the 14th National People’s Congress approved amendments to the law. They took effect on 1 January 2026. Reed Smith described them as the first major revision since the law took effect in 2017.
The amendments added provisions on artificial intelligence governance and development. They also aligned the law with the Personal Information Protection Law, which took effect in 2021, by requiring network operators to comply with it.
Penalties rose. Law firm Greenberg Traurig reported that, in aggravated circumstances such as leakage of massive data or partial dysfunction of critical information infrastructure, fines on a provider can run from RMB 500,000 to RMB 2 million. Responsible individuals can face fines of RMB 50,000 to RMB 200,000.
The localisation principle remains. Reed Smith said the revised law reaffirms that critical information infrastructure operators must store data locally. If they need to transfer data overseas, they must first pass a regulator-led security assessment. Standard contractual clauses and third-party certification are not available to them for this purpose.
The reach of enforcement also widened. Previously, overseas activities fell under the law only if they endangered critical information infrastructure. After the 2026 amendments, the law covers overseas activities that endanger China’s cybersecurity generally.