China Data Security Law (DSL)

Chapter IV: Data security protection obligations (Articles 27 to 36) – China Data Security Law (DSL)

China Data Security Law (DSL) 32: Art. 32 Lawful and proper collection; purposes and scope as the law provides

Organisations and individuals must collect data by lawful and proper means and may not acquire data by theft or other unlawful means; where laws or administrative regulations provide the purposes or scope of collection and use, data are collected and used for those purposes and within that scope.

Maintained by Gerard BlokdykControl text last updated 21 May 2026

Other controls in Chapter IV: Data security protection obligations (Articles 27 to 36) – China Data Security Law (DSL)

27 Art. 27 Whole-process data security management system, training, technical measures, the classified protection baseline, and named responsibility for important data
28 Art. 28 Processing and new data technologies conducive to development, welfare and ethics
29 Art. 29 Closer risk monitoring, immediate remediation of defects, immediate incident handling with user notification and reporting
30 Art. 30 Important data processors: regular risk assessments reported to the competent departments with the prescribed content
31 Art. 31 Outbound transfer of important data: CIIOs under the Cybersecurity Law, others under the CAC's measures
33-34 Art. 33-34 Data transaction intermediaries verify sources and identities and keep records; data services obtain the required administrative permits
35 Art. 35 Cooperate with public security and national security organs' lawful data requests
36 Art. 36 No provision of data stored in China to foreign judicial or law enforcement bodies without competent-authority approval

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All China Data Security Law (DSL) controls