CHINAGATEWAY.PRO
Contact

Glossary

CIIO (Critical Information Infrastructure Operator / 关键信息基础设施运营者)

Whether an operation in China counts as a critical information infrastructure operator (CIIO) drives three separate data obligations: mainland storage of personal information (PIPL Article 40), a mandatory security assessment for cross-border transfers (Order No.16 Article 7), and important-data export routing through the Cybersecurity Law (DSL Article 31). This page defines the term under State Council Decree No. 745, explains how designation works, and links each consequence to its on-site page.

Regulation metadata

The Regulation on the Security Protection of Critical Information Infrastructure (关键信息基础设施安全保护条例) is a State Council decree: 国令第745号. The decree block reads (Chinese official text, published at gov.cn):

中华人民共和国国务院令 第745号 《关键信息基础设施安全保护条例》已经2021年4月27日国务院第133次常务会议通过，现予公布，自2021年9月1日起施行。 总理　　李克强 2021年7月30日

Working English (not an official translation): State Council Decree of the PRC No. 745. The Regulation on the Security Protection of Critical Information Infrastructure was adopted at the 133rd executive meeting of the State Council on April 27, 2021, and is hereby promulgated, effective September 1, 2021. Premier Li Keqiang. July 30, 2021.

No official English translation of this regulation exists. The Chinese-verbatim-plus-working-English pairing follows the precedent on the PIPL and Cybersecurity Law glossary pages.

Source: gov.cn policy-library text, accessed 2026-10-04.

Definition — Article 2

Article 2 of the Regulation states (Chinese official text):

第二条 本条例所称关键信息基础设施，是指公共通信和信息服务、能源、交通、水利、金融、公共服务、电子政务、国防科技工业等重要行业和领域的，以及其他一旦遭到破坏、丧失功能或者数据泄露，可能严重危害国家安全、国计民生、公共利益的重要网络设施、信息系统等。

Working English: Critical information infrastructure as referred to in this Regulation means important network facilities and information systems in important industries and sectors such as public communication and information services, energy, transportation, water conservancy, finance, public services, electronic government affairs, and the national defense science-and-technology industry — as well as others that, once destroyed, lose function, or suffer data leakage, may seriously endanger national security, the national economy and public livelihood, or the public interest.

Two parts to the definition:

  1. Sector scope list, as printed: public communication and information services (公共通信和信息服务), energy (能源), transportation (交通), water conservancy (水利), finance (金融), public services (公共服务), electronic government affairs (电子政务), national defense science-and-technology industry (国防科技工业). The list is open — the Regulation writes 等 ("such as") after the eight named sectors — and closed by the harm test that follows.
  2. Harm test: the facility or system must be one that, once destroyed, loses function, or suffers data leakage, may seriously endanger national security (国家安全), the national economy and public livelihood (国计民生), or the public interest (公共利益).

An operator (运营者) is the entity that operates designated critical information infrastructure. The term is introduced in Article 4 of the Regulation. No named operators or operator counts appear in the regulation text.

How CIIO designation works

CIIO designation is not self-declared. The Regulation sets out a multi-step mechanism (Articles 8–11):

  1. Sector regulators are the protection work departments. Article 8: the competent departments and supervision-and-regulation departments for the industries and sectors in Article 2 are the departments responsible for CII security protection work (保护工作部门).
  2. Each protection work department writes its own designation rules. Article 9: the rules are filed with the State Council public-security department (国务院公安部门) for the record (备案). Rule formulation shall mainly consider: (1) importance of the network facilities and information systems to the key core business of the industry or sector; (2) the degree of harm that destruction, loss of function, or data leakage could cause; (3) correlated impact on other industries and sectors.
  3. The protection work department designates and notifies. Article 10: the department organizes designation according to its rules, notifies operators of the result, and reports to the State Council public-security department.
  4. Re-designation on material change. Article 11: where CII undergoes a major change that may affect its designation, the operator reports to the protection work department; the department completes re-designation within 3 months.

The designation rules themselves are filed for the record — not published in the regulation text. No public catalog of designated systems exists.

Three consequences for CIIOs

CIIO designation triggers obligations across three areas already documented on this site.

1. Data residency — PIPL Article 40

Article 40 of the PIPL requires critical information infrastructure operators — along with processors whose personal-information volume reaches the prescribed quantity — to store mainland-collected and -generated personal information inside the mainland. As stated on the PIPL page: "Article 40 requires certain operators — critical information infrastructure operators and processors above a prescribed volume threshold — to store mainland-collected and -generated personal information inside the mainland." The data residency page names CIIOs as one of the two triggering categories. For the PIPL duties that sit around that storage rule — lawful bases, notices, separate consent — see our PIPL compliance for foreign companies article.

2. Cross-border transfer mechanism — Order No.16 Article 7

CIIOs sit at the top rung of the cross-border transfer mechanism ladder. As stated on the cross-border data transfer page: "Critical information infrastructure operators (CIIOs) exporting personal information or important data" must pass the security assessment — regardless of volume. Non-CIIO processors follow the volume-based ladder below that rung. CIIOs do not.

3. Important-data export routing — DSL Article 31 → CSL

The Data Security Law names the Cybersecurity Law once: Article 31 of the DSL routes CIIO important-data export management to the CSL. As stated on the Cybersecurity Law page: "the DSL names the Cybersecurity Law in Article 31, routing CIIO important-data export management to the CSL." The CSL's own Article 38 governs the cross-border transfer regime for that class.

What this page does not cover

This page defines CIIO under the CII Security Protection Regulation, states the designation mechanism from Articles 8–11, and links to the three on-site pages that document the consequences. It does not cover:

Frequently asked questions

What is a critical information infrastructure operator (CIIO)?

An operator of designated critical information infrastructure. The CII Security Protection Regulation (国令第745号) defines critical information infrastructure in Article 2 as important network facilities and information systems in eight named sectors — public communication and information services, energy, transportation, water conservancy, finance, public services, electronic government affairs, and the national defense science-and-technology industry — plus others that meet the harm test. Designation runs through sector regulators (protection work departments), not self-declaration.

Does CIIO designation affect my cross-border transfer mechanism?

Yes. CIIOs sit at the top rung of the cross-border transfer ladder. As stated on the cross-border data transfer page, CIIOs exporting personal information or important data must pass the security assessment under Order No.16 Article 7 — regardless of volume. The volume-based ladder — exempt below 100,000 individuals where no important data is exported, SCC filing or certification in the 100,000–1,000,000 band — applies to non-CIIO processors only.

Does CIIO designation change my data-residency obligation?

Yes. Article 40 of the PIPL imposes the storage-localization mandate on two categories: critical information infrastructure operators, and processors whose personal-information volume reaches the prescribed quantity. As stated on the data residency page, CIIOs are one of the two categories that triggers the obligation to store mainland-collected and -generated personal information inside the mainland.

Is CIIO designation the same as MLPS classified protection?

No. Article 6 of the CII Regulation states that CII security protection operates "on the basis of network security classified protection" (在网络安全等级保护的基础上). The Regulation builds on the classified-protection system — it does not assign or certify MLPS levels, and the Cybersecurity Law page draws the same boundary. CIIO designation comes from the CII Regulation (Articles 8–10); MLPS classification is a separate track.

Who designates CIIOs — can I self-declare?

No. Under Articles 8–10 of the Regulation, the sector regulator for each industry or sector (the protection work department) writes designation rules, files them with the State Council public-security department for the record, organizes designation, and notifies operators of the result. There is no self-declaration mechanism in the regulation text.

Related terms

Related reading

Operating or designating infrastructure in China — and need to map the data obligations?

We coordinate the hosting decisions and regulatory classification behind CIIO-sensitive deployments. Start with the ICP & compliance service or the 10-point China readiness diagnostic.

hello@chinagateway.pro