China

The Cybersecurity Law (CSL) of the People’s Republic of China is in full force and effect, operating through an extensive reform process that was fully implemented on January 1, 2026. As the oldest structural element of China's data governance structure, the CSL governs activities of domestic networks, provides cybersecurity protection for Critical Information Infrastructure (CII), and enforces stringent data localization requirements for critical network infrastructure. Operated by a joint agency management structure consisting of the Cyberspace Administration of China (CAC) together with the Ministry of Public Security (MPS), the recent 2026 framework has done away with prior notice periods in favor of imposing direct financial fines, extended its jurisdictional reach to foreign cyber threats, and required stringent security compliance for artificial intelligence infrastructure.