Glossary

Cybersecurity Law (CSL)

China's framework cybersecurity law; it defines 'network', 'cybersecurity', and 'network operator', and the 2025 amendment takes effect 2026-01-01.

What the Cybersecurity Law is

The Cybersecurity Law of the People's Republic of China (CSL) was adopted on November 7, 2016, at the 24th Session of the Standing Committee of the 12th National People's Congress, and has been in force since June 1, 2017 (Article 79). It governs the construction, operation, maintenance, and use of networks within the territory of the People's Republic of China, and the supervision and regulation of cybersecurity (Article 2).

An amendment adopted on October 28, 2025, at the 18th Session of the Standing Committee of the 14th NPC takes effect on January 1, 2026. English renderings on this page are writer translations of the Chinese official text published at npc.gov.cn, not official translated quotes.

Article 76 defines the three terms that anchor the rest of China's cyber governance:

Network (网络), Article 76 — a system composed of computers or other information terminals and related equipment that collects, stores, transmits, exchanges, and processes information according to certain rules and procedures.
Cybersecurity (网络安全), Article 76 — the state in which a network runs stably and reliably — achieved by taking necessary measures against attacks on, intrusions into, interference with, damage to, and illegal use of networks, and against accidents — together with the capability to safeguard the integrity, confidentiality, and availability of network data.
Network operator (网络运营者), Article 76 — the owner of a network, its manager, and network service providers.
Stated purpose (Article 1) — to safeguard cybersecurity, maintain cyberspace sovereignty, national security, and the public interest, protect the lawful rights and interests of citizens, legal persons, and other organizations, and promote the sound development of economic and social informatization.
The 2025 amendment — the Standing Committee of the 14th NPC adopted the Decision on Amending the Cybersecurity Law on October 28, 2025. The decision takes effect on January 1, 2026, and the law is republished with adjusted article numbering. Xinhua describes the amendment as adapting the law "to the new situation and new requirements of cybersecurity, with the emphasis on strengthening cybersecurity legal liability and improving coordination with related laws."
Key amendment content (verbatim from the decision) — new Article 3: cybersecurity work adheres to the leadership of the Communist Party of China, implements the holistic approach to national security, coordinates development and security, and advances building a strong cyber nation.
New Article 20 (paragraph 1) — the state supports fundamental AI research and R&D of key technologies such as algorithms, advances infrastructure such as training-data resources and computing power, improves AI ethics norms, strengthens risk monitoring, assessment, and safety supervision, and promotes the application and sound development of AI.
Renumbered Article 42 (new paragraph) — when network operators process personal information, they shall comply with the Cybersecurity Law, the Civil Code of the PRC, the Personal Information Protection Law of the PRC, and other laws and administrative regulations. This is an explicit cross-reference between the CSL and the PIPL/Civil Code.
Penalty provisions renumbered — old Article 59 becomes Article 61 as renumbered by the 2025 amendment decision; the amendment adjusts fine tiers for network operators that fail to perform cybersecurity-protection obligations.
New Article 77 (renumbered from old Article 75) — overseas institutions, organizations, or individuals engaging in activities endangering PRC cybersecurity bear legal liability per law; where serious consequences result, the State Council public-security department and relevant departments may decide on measures such as freezing assets or other necessary sanctions.

What it means for foreign brands in China

Obligations attach to "network operators" as defined in Article 76(3) — the owner of a network, its manager, and network service providers — for networks built, operated, maintained, or used inside the mainland. A foreign company that operates a mainland-hosted website or app is a network operator under this definition.

The 2025 amendment adds an explicit CSL–PIPL link. Renumbered Article 42 requires network operators processing personal information to comply with the Civil Code and the PIPL alongside the CSL — the three-statute relationship, now stated in the law text itself.

The amendment adds an AI-support provision. New Article 20 directs the state to support fundamental AI research, algorithm R&D, training-data and computing-power infrastructure, AI ethics norms, and risk monitoring. It is a policy-direction article, not an obligation on network operators — but it signals the environment AI-facing products will be regulated in.

The overseas-sanctions clause (new Article 77) targets conduct, not territorial scope. It authorizes asset freezes and other sanctions against overseas institutions, organizations, or individuals whose activities endanger PRC cybersecurity and cause serious consequences. This is a sanctions mechanism, not an extraterritorial application of the law's operational obligations. Article 2 remains territorial.

What the Cybersecurity Law does NOT mean

It is not a filing you obtain. The CSL is a statute, not a license or certificate. There is no "CSL compliance certificate" to apply for.
It is not the same as the PIPL or the DSL. The CSL governs cybersecurity of networks. The PIPL governs personal information. The Data Security Law governs all data, including non-personal data. The three are separate statutes with separate scopes. The 2025 amendment's new Article 42 cross-references the PIPL and Civil Code but does not merge them.
It does not contain an extraterritorial scope clause. Article 2 is territorial. The DSL's Article 2 and the PIPL's Article 3 both contain extraterritorial provisions; the CSL's Article 2 does not. The new Article 77 overseas-sanctions clause authorizes sanctions against overseas persons but does not extend the law's operational obligations beyond the mainland.
It does not come with MLPS (classified protection) implementation details on this site. The on-site Data Security Law page references the classified protection system for cybersecurity in the context of DSL Article 27. This page does not expand on MLPS levels or certification — that material is not banked from the CSL text itself.
It does not come with an official English translation. No official English rendering of the CSL exists — the NPC's English-language site carries no CSL text. Every English quotation on this page is a writer translation of the Chinese text. Third-party translations are not cited.

Where this appears on this site

Data Security Law glossary page — the DSL names the Cybersecurity Law in Article 31, routing CIIO important-data export management to the CSL. The DSL page's "Relationship to PIPL and the Cybersecurity Law" section documents the relationship.
PIPL glossary page — the personal-information statute; the 2025 amendment's new Article 42 makes the CSL–PIPL cross-reference explicit. Our PIPL compliance for foreign companies article walks that statute's obligations in practice.
Cross-border data transfer — the transfer-mechanism page; a brand planning a cross-border transfer is, on the mainland side, a network operator subject to CSL obligations.
Regulations timeline — the CSL sits alongside the DSL, PIPL, and CAC data-export orders as part of the broader data-governance landscape.

Frequently asked questions

When was the Cybersecurity Law adopted and when did it take effect?

The Cybersecurity Law of the People's Republic of China was adopted on November 7, 2016, at the 24th Session of the Standing Committee of the 12th National People's Congress. Article 79 states: "This Law comes into force on June 1, 2017." The 2025 amendment was adopted on October 28, 2025, and takes effect on January 1, 2026.

What does the CSL define as "network", "cybersecurity", and "network operator"?

Article 76 defines all three. A network is a system of computers or other information terminals and related equipment that collects, stores, transmits, exchanges, and processes information according to certain rules and procedures. Cybersecurity is the state of stable, reliable network operation plus the capability to safeguard network data integrity, confidentiality, and availability. A network operator is the network's owner, its manager, or a network service provider.

Does the CSL apply to companies outside mainland China?

Article 2 limits the law's operational scope to activities within the territory of the People's Republic of China. There is no extraterritorial clause in Article 2. The 2025 amendment adds Article 77, which authorizes sanctions against overseas persons whose activities endanger PRC cybersecurity and cause serious consequences — but this is a sanctions mechanism, not an extension of the law's day-to-day obligations to offshore operations. A foreign company that operates a mainland-hosted website or app is a network operator under Article 76 and falls within scope.

How does the CSL relate to the PIPL and the Data Security Law?

They are separate statutes. The CSL governs cybersecurity of networks. The PIPL governs personal information. The DSL governs all data. The DSL names the CSL once (Article 31, routing CIIO important-data export management to the CSL) and does not mention the PIPL. The 2025 amendment adds an explicit cross-reference in renumbered Article 42: network operators processing personal information must comply with the CSL, the Civil Code, and the PIPL.

What changed in the 2025 amendment?

The amendment adds new Article 3 (Communist Party leadership and the holistic approach to national security), new Article 20 (state support for AI research, algorithm R&D, computing infrastructure, and AI ethics norms), an explicit CSL–PIPL–Civil Code cross-reference in renumbered Article 42, adjusted penalty tiers with renumbered articles, and the overseas-sanctions clause in new Article 77. Xinhua frames the amendment as "strengthening cybersecurity legal liability and improving coordination with related laws." Article numbering shifts throughout (e.g., old Article 59 becomes Article 61 as renumbered by the 2025 amendment decision).

Sources

Sources: All provisions cited on this page come from the Chinese-language official text of the Cybersecurity Law published at npc.gov.cn — www.npc.gov.cn/npc/c2/c30834/201905/t20190521_274248.html, accessed 2026-10-03; the Chinese-language amendment decision — www.npc.gov.cn/npc/c2/c30834/202510/t20251028_449048.html, accessed 2026-10-03; and the Xinhua report on the amendment — www.npc.gov.cn/c2/c30834/202510/t20251028_449076.html, accessed 2026-10-03 (page credits 来源：新华网). No official English translation of the CSL exists. English renderings on this page are writer translations of the Chinese official text, not official translated quotes. The published law text carries no presidential-order number, so none is printed here. Enforcement practice and agency-enforcement mapping are deliberately not printed: no banked primary supports them.

Related terms

Data Security Law (DSL) — the all-data framework statute; the CSL's sibling, not its parent. The DSL's Article 31 routes CIIO important-data export management to the CSL.
PIPL (个人信息保护法) — the personal-information statute. The 2025 amendment's new Article 42 makes the CSL–PIPL cross-reference explicit in the law text.
Cross-Border Data Transfer (China) — the three Article 38 PIPL mechanisms and the 2024 exemption tiers; the companion page for moving mainland data offshore.
CAC (Cyberspace Administration of China) — the authority behind the data-export orders that operationalize the PIPL's Article 38 transfer regime.
Data Residency in China — the storage-side localization question, driven by PIPL Article 40.