China Data Security Law (DSL) 30: Art. 30 Important data processors: regular risk assessments reported to the competent departments with the prescribed content

Processors of important data must, in accordance with the relevant provisions, conduct risk assessments of their data processing on a regular basis and submit the risk assessment reports to the relevant competent departments; the reports include the types and amounts of important data processed, information on the processing, the data security risks and the response measures (the 2025 Regulations make the assessment annual and extend it to processors of more than 10 million individuals' personal information).