Regulation 2024
银行保险机构数据安全管理办法（金规〔2024〕24号） (Data Security Management Measures for Banking and Insurance Institutions)
Plain-English summary
NFRA document Jin Gui [2024] No. 24 of 27 December 2024, effective on promulgation (Art. 81), replacing Yinbaojian Ban Fa [2022] No. 118. Sets core, important and general data classes (Arts. 16-19), an annual data security risk assessment (Art. 66), incident reporting within 2 hours with a written report within 24 hours (Art. 69), a 20-working-day advance report for batch sharing or outsourcing of sensitive-level data (Art. 73) and fines of RMB 200,000 to 500,000 for banking institutions and RMB 50,000 to 300,000 for insurers (Art. 77).
Who it applies to
Banking · Insurance
Topics
Data Protection & Privacy Cybersecurity & IT Risk Operational Risk & Outsourcing
Obligations arising from this law or regulation
| Obligation | Timing | Regulator | Source | Detail |
|---|---|---|---|---|
| Report data security incidents to NFRA within 2 hours | Deadline Within 2 hours; written report within 24 hours | NFRA | source | |
Art. 69 requires banking and insurance institutions to report data security incidents to the NFRA or its local office within 2 hours and to submit a written report within 24 hours. For especially major incidents they must also act immediately, notify users as required and report to the local public security authority, with updates every 2 hours until handling ends. A post-incident assessment and improvement report is due within 5 working days after handling ends. |
||||
| No obligations match these filters. | ||||
Latest news
No related news yet. We publish updates as regulators act.