On 10 July 2021, the Cyberspace Administration of China (CAC) – i.e. China’s top cyberspace regulator – announced the revision of the Measures for Cybersecurity Review (effective since 1 June 2020), soliciting public comments until 25 July 2021.
Since the Data Security Law (DSL) was recently released and is going to be implemented from September 2021, the Measures were revised to incorporate this law as their legal basis, and to specify the protection of core data, whose concept was first determined in DSL. While the majority of the Measures remains unchanged, the revised version tightens grip on data transfer and all foreign public listings.
For instance, the currently implemented Measures require that critical information infrastructure operators (CIIOs) undergo through cybersecurity review when purchasing network products and services that (may) affect national security. However, the revised Measures stipulate that cybersecurity review also applies to data processors and operators who have personal information of more than one million users and are going to list abroad. This is the main change in the Measures, and it is particularly noteworthy as in the Chinese market many Internet platforms have stored information of over 10 million or even 100 million users: the reduced threshold of a million users means that almost all platforms operating in China which aspire to sell shares abroad will need to go through a cybersecurity review.
The revised Measures followed a series of regulatory actions taken against internet firms over cybersecurity protection, among which the most notable is a cybersecurity review of Didi just days after it launched an IPO in the United States, on grounds of “serious violations of the law and regulation” in its collection and use of personal information.
The awareness of protecting data security was not sufficient when many Chinese firms got listed in the US in the past. Given the rising risks, the revision is seen as in line with China’s national interest to strengthen cybersecurity-related laws and regulations.
The full text of the revised Measures for Cybersecurity Review is available at:
