China steps up cybersecurity efforts

The Chinese government has been ramping up its cyber and data security efforts in recent times and risk managers with firms active in the PRC need to sit up and take note. President Xi Jinping has made it clear that China needs to be a cyber “superpower”, and repeated his call at a recent high-level conference organised by the Cyberspace Administration of China (CAC). The ambitious targets set by the nation’s leader are being diligently followed through by law makers and regulators. James Gong, China-based partner with international law firm Bird & Bird, advises firms active in China to take note of the latest developments in a recent note. Gong pointed to the significance of the recent move by China’s Cybersecurity Administration Bureau of the Ministry of Industry and Information Technology (MIIT) to introduce the Implementation Rules for Data Security Risk Assessment in the Industry and Information Technology. These rules are designed to serve as a comprehensive guide for local industry regulators and data processors in conducting thorough data security risk assessments. Gong stressed that risk assessment has emerged as a critical step in ensuring data security, hence the arrival of the rules that clarify the key concepts and mechanisms within the risk assessment system in the industry and information technology sector. The lawyer explained that prior to the introduction of the rules, Article 30 of the PRC Data Protection Law (DSL) requires important data processors to conduct regular risk assessments of their data-processing activities in accordance with regulations, and submit the risk assessment reports to the relevant competent authorities. Based on this requirement, the Regulations on the Management of Network Data Security outlined explicit requirements on the content of the risk assessment, as well as the timeline for reporting to the authorities. Particularly in the field of industry and information technology, the MIIT issued the Measures for the Administration of Data Security in the Field of Industry and Information Technology in December 2022. Gong explained that these specified the requirements for the risk assessment, but did not provide details regarding assessment content or procedures. The MIIT therefore released the new draft rules on 9 October 2023 and the final rules to fill this gap by offering a comprehensive explanation of how to conduct these assessments, he said. “The rules aim to provide guidance on the risk assessment of important data and core data processors in the industrial and information technology sectors. The MIIT has taken a step closer towards establishing its data security regime revolving around the data categorisation and classification system,” explained Gong. The implementation of the rules will impose “significant” obligations for all companies involved in data-processing activities in their relevant industries, particularly for important data and core data processors that will need to apply for risk assessments, advised the lawyer. “To effectively assess and mitigate data security risks, it is imperative for the data processors to conduct thorough data mapping and gain a comprehensive understanding of the important data and core data that they process, as well as the specific data processing activities, sources, and flows. Additionally, companies should strengthen their internal data security management and technical protective measures to ensure data security and compliance, essential for successfully passing the risk assessment,” concluded Gong. As Bird & Bird pointed out in its latest China cybersecurity update, this measure is part of a much wider effort to place China at the forefront of cybersecurity. Back in March, the National Information Security Standardisation Technical Committee (TC260) issued five recommended cybersecurity standards, including: Data security technology – rules for data classification and grading; Information Technology Security Technical Non-repudiation Part 1; and, Information Technology Security Techniques Non-repudiation Part 3. The standard provides principles, frameworks, methods, and processes for data classification and grading, and provides guidelines for identifying important data. More specifically, the standard outlines data classification rules, methods, and frameworks, as well as level determination rules. At the end of May, the TC260 issued a notice to solicit proposals for ISO/IEC JTC1/SC27 international cybersecurity standards. “This initiative aims to promote the international standardisation of China’s cybersecurity technologies and applications, encouraging the export of excellent practices and research project standards. Proposals should prioritise areas such as AI security, IoV security, and personal information protection, and they provided that applicant organisations must have relevant research capabilities and practical experience,” explained the law firm. In late June, the Cyberspace Administration of China (CAC) held a symposium on rule of law in cyberspace to support building a cyber power, focusing on President Xi Jinping’s thoughts on the rule of law and his ideas on building a cyber power. The meeting reviewed 30 years of China’s efforts in cyberspace law, outlined new tasks and directions, and emphasised the need to enhance the legal framework, law enforcement, public legal awareness and international cooperation. The symposium, chaired by Zhuang Rongwen, head of CAC, included speeches from leaders of the Ministry of Public Security and Ministry of Justice stressing the importance of robust legal support for the high-quality development of the cyberspace sector.

China steps up cybersecurity efforts

Risk managers need to focus on risk assessment

Want to read this article?

Read Next

EU Data privacy claims filed against six Chinese firms

Singapore general insurance market set to ‘thrive’

German insurers demand clarity on DORA

Litigation expected to be even bigger US risk in 2025

LA wildfires now projected to cause up to $45bn of insured losses

EU Data privacy claims filed against six Chinese firms

Singapore general insurance market set to ‘thrive’

German insurers demand clarity on DORA

Litigation expected to be even bigger US risk in 2025

LA wildfires now projected to cause up to $45bn of insured losses

Keep yourself informed

Sign up for Commercial Risk’s newsletters

Want to read this article?

Read Next

EU Data privacy claims filed against six Chinese firms

Singapore general insurance market set to ‘thrive’

German insurers demand clarity on DORA

Litigation expected to be even bigger US risk in 2025

LA wildfires now projected to cause up to $45bn of insured losses

Related Articles

Keep yourself informed

Sign up for Commercial Risk’s newsletters