China Data Security Law (DSL) 27: Art. 27 Whole-process data security management system, training, technical measures, the classified protection baseline, and named responsibility for important data

In data processing the laws and regulations must be complied with, a sound data security management system covering the whole process established, data security education and training organised, and corresponding technical and other necessary measures adopted to ensure data security; processing over the internet or other information networks fulfils these obligations on the basis of the classified protection system for cybersecurity (MLPS); and processors of important data must make clear their persons responsible for data security and their data security management bodies and perform their data security responsibilities.