China Cybersecurity Law (CSL) 42-43: Art. 42-43 User information kept secret under a protection system; personal information collected lawfully, legitimately and necessarily, with public rules, stated purposes and consent, and nothing unrelated to the service

What does 42-43 require?

Network operators must keep the user information they collect strictly confidential and build and improve a user information protection system; the 2025 Decision added a second paragraph to Article 42 requiring network operators that process personal information to comply with this Law and with the Civil Code, the Personal Information Protection Law and other laws and administrative regulations. In collecting or using personal information they follow the principles of lawfulness, legitimacy and necessity, publish their collection and use rules, state the purpose, method and scope, and obtain the consent of the person whose information is collected (Article 43, paragraph 1); they may not collect personal information unrelated to the services they provide, may not collect or use it in breach of laws, administrative regulations or the parties' agreement, and must process the personal information they hold as the laws, administrative regulations and their user agreements provide (paragraph 2). As amended, infringements of Articles 43 to 45 are handled and penalised under the relevant laws and administrative regulations (Article 71(2)), which in practice means the Personal Information Protection Law.