Glossary

Data Security Law (DSL)

China's framework law for data processing; source of the "important data" trigger that feeds the cross-border security assessment.

What the Data Security Law is

The Data Security Law of the People's Republic of China was adopted on June 10, 2021, and took effect on September 1, 2021 (Presidential Order No. 84).

Its stated purposes (Art. 1) are to regulate data processing, ensure data security, promote development and utilization of data, protect the lawful rights and interests of individuals and organizations, and safeguard state sovereignty, security, and development interests.

Scope (Art. 2): the law applies to data processing activities and security supervision of those activities within the territory of the People's Republic of China. A second paragraph adds an extraterritorial clause — data processing outside the territory that harms national security, public interests, or the lawful rights and interests of individuals or organizations in China may give rise to legal liability.

The law defines "data" broadly as any record of information in electronic or any other form, and "data processing" as collection, storage, use, processing, transmission, provision, and disclosure (Art. 3).

What it means for foreign brands in China

The DSL introduces a data-grading system. Under Art. 21, the state establishes a categorized and classified system and grades data by two criteria: the data's importance in economic and social development, and the extent of harm to national security, public interests, or the lawful rights and interests of individuals or organizations if the data were altered, destroyed, leaked, or illegally obtained or used. Obligations scale with the grade.

Art. 21 directs the national data-security coordination mechanism to formulate a catalog of important data, and directs each locality and department to prepare specific catalogs for their regions and sectors. The law itself does not publish a closed definition of "important data" — classification is catalog-based.

Art. 21 also defines a stricter tier: "core data" — data concerning national security, lifelines of the national economy, important aspects of people's lives, and major public interests. Core data is subject to a stricter management system.

For a website or app operator running a mainland China service, the DSL's most directly relevant obligations are:

Art. 27 — establish a sound data security management system throughout the whole process, adopt corresponding technical measures, and fulfill these obligations on the basis of the classified protection system for cyber security.
Art. 29 — where data security defects, bugs, or risks are discovered, take remedial measures immediately; where a data security incident occurs, address it, notify users, and report to competent departments.
Art. 30 — processors of important data must conduct risk assessments on a regular basis and submit risk assessment reports to competent departments.
Art. 36 — without approval of competent authorities, organizations or individuals in China shall not provide data stored within China to any overseas judicial or law enforcement body.

Relationship to PIPL and the Cybersecurity Law

The DSL names the Cybersecurity Law exactly once — in Art. 31, which routes outbound security management of important data collected or produced by critical information infrastructure operators to the Cybersecurity Law, and directs the national cyberspace authority, in conjunction with relevant departments under the State Council, to formulate measures for important data collected or produced by other processors. The DSL does not mention the Personal Information Protection Law by name. The PIPL and the DSL are separate statutes; the PIPL governs personal information, the DSL governs all data. Coverage of PIPL and cross-border transfer mechanisms lives on the PIPL glossary page and the cross-border data transfer page.

What the Data Security Law does NOT mean

It is not a filing you obtain. The DSL is a statute, not a license or certificate. There is no "DSL compliance certificate" to apply for.
It is not the same as the PIPL. The PIPL governs personal information; the DSL governs all data, including non-personal data. The two laws overlap but have different scopes.
It does not publish a closed catalog of "important data" you can look yourself up in. Art. 21 grades data by a harm test and directs sectoral and regional catalogs to be compiled. The catalogs are issued by individual departments and localities, not consolidated in the statute.
It does not replace the PIPL or the Cybersecurity Law. The DSL adds the data-grading framework and the "important data" concept on top of the existing statutes. The PIPL keeps its own scope, and Art. 31 routes CIIO important-data export management to the Cybersecurity Law.

Where this appears on this site

Cross-border data transfer — the transfer-mechanism page uses "important data" in its threshold ladder (CAC Order No.16 Art. 7 triggers a security assessment for any processor exporting important data). This DSL page supplies the definition anchor for that term.
PIPL — the personal-information statute; the DSL's sibling, not its parent. Our PIPL compliance for foreign companies article walks its obligations in practice.
Data residency — the storage-side localization question, driven by PIPL Article 40 (CIIO status and volume thresholds). "Important data" feeds the transfer-assessment ladder, not the localization trigger.
Regulations timeline — the four-domain framing (MIIT notices, CAC orders, a SAFE measure, WeChat platform gates) sits alongside the DSL as part of the broader data-governance landscape.

Frequently asked questions

When did the Data Security Law take effect and what is its order number?

The Data Security Law of the People's Republic of China was adopted on June 10, 2021, promulgated under Presidential Order No. 84, and took effect on September 1, 2021.

Does the DSL apply to a foreign company's China website?

Art. 2 states the law applies to data processing activities and security supervision within the territory of the People's Republic of China. A foreign company that operates a website or app serving mainland users and processes data inside the mainland falls within that scope. Art. 2 also contains an extraterritorial clause: data processing outside China that harms national security, public interests, or the lawful rights and interests of individuals or organizations in China may give rise to legal liability.

What is "important data" under the DSL?

The DSL does not publish a closed definition. Art. 21 establishes a harm-based grading test — data is graded by its importance in economic and social development and the extent of harm a leak would cause — and directs the national coordination mechanism and individual departments and localities to compile catalogs of important data. Operationally, whether a specific dataset counts as "important data" depends on the applicable sectoral or regional catalog, not on a single statutory definition.

Does the DSL replace the PIPL?

No. They are separate statutes: the DSL governs all data, including non-personal data, while the PIPL governs personal information. The DSL text never mentions the PIPL; personal-information obligations remain governed by the PIPL itself.

What is "core data" under the DSL?

Art. 21 defines a stricter tier above "important data": "core data" — data concerning national security, lifelines of the national economy, important aspects of people's lives, and major public interests. Core data is subject to a stricter management system.

Sources

Sources: All provisions cited on this page come from the official NPC English translation of the Data Security Law of the People's Republic of China — www.npc.gov.cn/englishnpc/c2759/c23934/202112/t20211209_385109.html, accessed 2026-10-02. Quotes follow that official English rendering, not the Chinese original. The Order No.16 Art. 7 "important data" trigger cited on this page is an on-site fact from the cross-border data transfer page, banked in the source registry. Enforcement practice, sector catalogs issued to date, and the law's Chinese title characters are deliberately not printed: no banked primary supports them.

Related terms

Cross-Border Data Transfer (China) — the three Article 38 mechanisms and the 2024 exemption tiers; uses "important data" as an Order No.16 Art. 7 assessment trigger, for which this page is the definition anchor.
PIPL (个人信息保护法) — the personal-information statute; the DSL's sibling, not its parent.
Data Residency in China — the storage-side localization question; "important data" feeds the transfer-assessment ladder, not the localization trigger.
CAC (Cyberspace Administration of China) — the authority behind the data-export orders that operationalize the "important data" trigger.