💬 General consulting

Data Security Law · Yalla China

中华人民共和国数据安全法 / Data Security Law

Enacted: 2021-06-10 ✅ Effective: 2021-09-01

📝 Overview

The law that sets out how organisations must classify, protect and handle data, with special care for important data and cross-border data transfers. It complements the Personal Information Protection Law and matters to anyone running a business that handles data.

This is general information only, not legal advice. For your specific case, consult a licensed lawyer.

📜 The law text / key provisions

Key practical points:
• Organisations must classify the data they collect according to its importance and sensitivity.
• The more important the data, the greater the protection and security measures required.
• Special care applies to so-called important data that could affect security or the public interest.
• Transferring data outside China is subject to stricter rules and may require reviews or approvals.
• Companies should put in place a data security management system and assign clear internal responsibilities.
• This law complements the Personal Information Protection Law; this one focuses on data security generally, the other on individuals' data.
• Non-compliance can lead to fines and suspension of the non-compliant data-processing activities.

💬 Practical reading

💬 This is a general reading/opinion for orientation — not the official legal text nor legal advice.

This law is aimed mainly at business owners and organisations that collect or process data in China, not at the ordinary individual user. Its central idea is that data is classified by its importance, and the more important it is the greater your responsibility to protect it, with especially strict rules when it is transferred outside China. If you run a company that handles customer data, it is important to build a clear data security system and coordinate with the Personal Information Protection Law. This is general orientation only, not formal legal advice.

🚔 Illustrative example / related case

Illustrative, general educational examples — not real specific facts and not legal advice; for awareness only. For an actual situation, consult a licensed lawyer.

An App Using Customer Data Beyond the Stated Purpose

The situation: Customers register on a small shop's app and provide phone numbers and addresses only for delivery. Later the shop sells or shares this data with advertisers, and customers start receiving unwanted marketing messages and calls. Several file complaints and ask to see what data was collected and to have it deleted.

Applicable law: Under the Personal Information Protection Law and the Data Security Law, personal data must be collected with clear consent for a specific, stated purpose, kept secure, and not used or shared beyond that purpose. Users also have the right to access, correct, and delete their data and to withdraw consent.

Typical outcome: The shop is required to stop the unauthorised sharing, let users access and delete their data, and correct its practices; it may face administrative liability if it fails to comply.

🎓 The lesson / takeaway: Lesson: Collect customer data only with clear consent and for a specific purpose, protect it, and do not share it beyond that purpose. Respect users' rights to access and delete. As a user, read the privacy policy and check permissions before agreeing.

Read the full case →

📎 Official source npc.gov.cn / cac.gov.cn

🕒 Updated: 16 March 2026

Data Security Law · Yalla China

📝 Overview

📜 The law text / key provisions

💬 Practical reading

🚔 Illustrative example / related case

✦ How to benefit from this section