China

The Data Security Law of the People's Republic of China that came into force on September 1, 2021, is an all-encompassing legal regulation that views data as a valuable resource linked to the national security and sovereignty of the country. As opposed to privacy regulations concentrated only on protecting the rights of consumers, the DSL adopts a hierarchical structure that classifies data depending on the level of its influence on the public interest and stability of the state as General, Important, and Core Data. The law places restrictions on the cross-border transfer of data, demanding the prior consent of the government before any domestic entities transfer the data to foreign governmental, judicial, or law enforcement agencies. At the same time, the DSL declares extraterritorial jurisdiction over the processing of data abroad that may cause harm to the national interests of China. Under the threat of harsh penalties, such as fines of up to 10 million RMB and even license revocation, the DSL obliges companies to have secure architecture and perform regular risk assessments.