China Data Security Law (DSL)
The Data Security Law of the People's Republic of China (effective September 1, 2021) establishes a comprehensive framework for data security governance. It introduces a data classification and grading system, cross‑border data transfer restrictions, security assessment mechanisms, government data security obligations, and a national security assessment system for data handling.
China Data Security Law (DSL) is a compliance framework from People's Republic of China (with extraterritorial liability under Article 2) with 3 domains and 14 controls that map to 4 other frameworks. The largest domains are Chapter IV: Data security protection obligations (Articles 27 to 36) – China Data Security Law (DSL) (9 controls), Chapter V: Security and openness of government data (Articles 38 to 41) – China Data Security Law (DSL) (3 controls), Chapter III: Data security systems that bind processors (classification, review, export control) – China Data Security Law (DSL) (2 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (3)
Chapter III: Data security systems that bind processors (classification, review, export control) – China Data Security Law (DSL)
| Code | Title |
|---|---|
| china-data-security-law-dsl::21 | Art. 21 Classify and grade data, identify important data by the catalogues, and apply the stricter regime to national core data |
| china-data-security-law-dsl::24-25 | Art. 24-25 Submit to national security review of data processing that affects national security; observe export control on controlled data |
Chapter IV: Data security protection obligations (Articles 27 to 36) – China Data Security Law (DSL)
| Code | Title |
|---|---|
| china-data-security-law-dsl::27 | Art. 27 Whole-process data security management system, training, technical measures, the classified protection baseline, and named responsibility for important data |
| china-data-security-law-dsl::28 | Art. 28 Processing and new data technologies conducive to development, welfare and ethics |
| china-data-security-law-dsl::29 | Art. 29 Closer risk monitoring, immediate remediation of defects, immediate incident handling with user notification and reporting |
| china-data-security-law-dsl::30 | Art. 30 Important data processors: regular risk assessments reported to the competent departments with the prescribed content |
| china-data-security-law-dsl::31 | Art. 31 Outbound transfer of important data: CIIOs under the Cybersecurity Law, others under the CAC's measures |
| china-data-security-law-dsl::32 | Art. 32 Lawful and proper collection; purposes and scope as the law provides |
| china-data-security-law-dsl::33-34 | Art. 33-34 Data transaction intermediaries verify sources and identities and keep records; data services obtain the required administrative permits |
| china-data-security-law-dsl::35 | Art. 35 Cooperate with public security and national security organs' lawful data requests |
| china-data-security-law-dsl::36 | Art. 36 No provision of data stored in China to foreign judicial or law enforcement bodies without competent-authority approval |
Chapter V: Security and openness of government data (Articles 38 to 41) – China Data Security Law (DSL)
| Code | Title |
|---|---|
| china-data-security-law-dsl::38-39 | Art. 38-39 State organs collect and use data within their statutory duties, keep it confidential, and run data security management systems |
| china-data-security-law-dsl::40 | Art. 40 Entrusting e-government systems or government data: strict approval, supervision, and the entrusted party's duties |
| china-data-security-law-dsl::41 | Art. 41 Disclose government data timely and accurately except where non-disclosure is required |
Your Compliance Coverage
If you comply with China Data Security Law (DSL), you already cover:
Maps to 4 other frameworks
Coverage is not the same as your position
This page shows what China Data Security Law (DSL) overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is China Data Security Law (DSL) and who does it apply to?
China Data Security Law (DSL) is a compliance framework from People's Republic of China (with extraterritorial liability under Article 2) with 3 domains and 14 controls. The Data Security Law of the People's Republic of China (effective September 1, 2021) establishes a comprehensive framework for data security governance. It introduces a data classification and grading system, cross‑border data transfer restrictions, security assessment mechanisms, government data security obligations, and a national security assessment system for data handling. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does China Data Security Law (DSL) actually require?
China Data Security Law (DSL) has 14 controls organised across 3 domains. The largest domains are Chapter IV: Data security protection obligations (Articles 27 to 36) – China Data Security Law (DSL) (9 controls), Chapter V: Security and openness of government data (Articles 38 to 41) – China Data Security Law (DSL) (3 controls), Chapter III: Data security systems that bind processors (classification, review, export control) – China Data Security Law (DSL) (2 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of China Data Security Law (DSL) do I already cover?
China Data Security Law (DSL) maps to 4 other compliance frameworks. The top mapping partners are NIST Cybersecurity Framework 2.0 (20% coverage), China Personal Information Protection Law (PIPL) (9% coverage), GDPR (3% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement China Data Security Law (DSL)?
Start your China Data Security Law (DSL) compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about China Data Security Law (DSL) requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 14 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,120 frameworks.
Get Started Free →Free forever, no credit card required