KYB CHINA(2024年8月30日国务院第40次常务会议通过 2024年9月24日中华人民共和国国务院令第790号公布 自2025年1月1日起施行)
(Adopted at the 40th Executive Meeting of the State Council on August 30, 2024, promulgated by Order No. 790 of the State Council of the People's Republic of China on September 24, 2024, effective from January 1, 2025)
总 则
General Provisions
为了规范网络数据处理活动，保障网络数据安全，促进网络数据依法合理有效利用，保护个人、组织的合法权益，维护国家安全和公共利益，根据《中华人民共和国网络安全法》、《中华人民共和国数据安全法》、《中华人民共和国个人信息保护法》等法律，制定本条例。
These Regulations are formulated in accordance with the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, the Personal Information Protection Law of the People's Republic of China, and other laws, for the purposes of regulating network data processing activities, ensuring network data security, promoting the lawful, reasonable, and effective use of network data, protecting the lawful rights and interests of individuals and organizations, and safeguarding national security and public interests.
在中华人民共和国境内开展网络数据处理活动及其安全监督管理，适用本条例。
These Regulations apply to network data processing activities conducted within the territory of the People's Republic of China and the security supervision and management thereof.
在中华人民共和国境外处理中华人民共和国境内自然人个人信息的活动，符合《中华人民共和国个人信息保护法》第三条第二款规定情形的，也适用本条例。
Activities conducted outside the territory of the People's Republic of China that process the personal information of natural persons within the territory of the People's Republic of China, which meet the circumstances specified in Paragraph 2 of Article 3 of the Personal Information Protection Law of the People's Republic of China, shall also be governed by these Regulations.
在中华人民共和国境外开展网络数据处理活动，损害中华人民共和国国家安全、公共利益或者公民、组织合法权益的，依法追究法律责任。
Where network data processing activities conducted outside the territory of the People's Republic of China harm the national security, public interests, or the lawful rights and interests of citizens or organizations of the People's Republic of China, legal liability shall be pursued in accordance with the law.
网络数据安全管理工作坚持中国共产党的领导，贯彻总体国家安全观，统筹促进网络数据开发利用与保障网络数据安全。
Network data security management shall adhere to the leadership of the Communist Party of China, implement a holistic approach to national security, and coordinate the promotion of network data development and utilization with the protection of network data security.
国家鼓励网络数据在各行业、各领域的创新应用，加强网络数据安全防护能力建设，支持网络数据相关技术、产品、服务创新，开展网络数据安全宣传教育和人才培养，促进网络数据开发利用和产业发展。
The State encourages innovative applications of network data in various industries and fields, strengthens the construction of network data security protection capabilities, supports innovation in network data-related technologies, products, and services, carries out network data security publicity, education, and talent training, and promotes the development and utilization of network data and industrial development.
国家根据网络数据在经济社会发展中的重要程度，以及一旦遭到篡改、破坏、泄露或者非法获取、非法利用，对国家安全、公共利益或者个人、组织合法权益造成的危害程度，对网络数据实行分类分级保护。
The State implements classified and graded protection of network data based on the importance of network data in economic and social development, as well as the degree of harm caused to national security, public interests, or the lawful rights and interests of individuals or organizations in the event of tampering, destruction, leakage, or illegal acquisition or illegal use.
国家积极参与网络数据安全相关国际规则和标准的制定，促进国际交流与合作。
The State actively participates in the formulation of international rules and standards related to network data security and promotes international exchanges and cooperation.
国家支持相关行业组织按照章程，制定网络数据安全行为规范，加强行业自律，指导会员加强网络数据安全保护，提高网络数据安全保护水平，促进行业健康发展。
The State supports relevant industry organizations in formulating network data security codes of conduct in accordance with their articles of association, strengthening industry self-discipline, guiding their members to enhance network data security protection, improving the level of network data security protection, and promoting the healthy development of the industry.
一 般 规 定
General Provisions
任何个人、组织不得利用网络数据从事非法活动，不得从事窃取或者以其他非法方式获取网络数据、非法出售或者非法向他人提供网络数据等非法网络数据处理活动。
No individual or organization shall engage in illegal activities using network data, nor engage in illegal network data processing activities such as stealing or otherwise illegally obtaining network data, illegally selling or illegally providing network data to others.
任何个人、组织不得提供专门用于从事前款非法活动的程序、工具；明知他人从事前款非法活动的，不得为其提供互联网接入、服务器托管、网络存储、通讯传输等技术支持，或者提供广告推广、支付结算等帮助。
No individual or organization shall provide programs or tools specifically used for engaging in the illegal activities mentioned in the preceding paragraph; where knowing that others are engaged in the illegal activities mentioned in the preceding paragraph, they shall not provide technical support such as Internet access, server hosting, network storage, or communication transmission, or provide assistance such as advertising promotion or payment settlement.
网络数据处理者应当依照法律、行政法规的规定和国家标准的强制性要求，在网络安全等级保护的基础上，加强网络数据安全防护，建立健全网络数据安全管理制度，采取加密、备份、访问控制、安全认证等技术措施和其他必要措施，保护网络数据免遭篡改、破坏、泄露或者非法获取、非法利用，处置网络数据安全事件，防范针对和利用网络数据实施的违法犯罪活动，并对所处理网络数据的安全承担主体责任。
Network data processors shall, in accordance with the provisions of laws and administrative regulations and the mandatory requirements of national standards, on the basis of cybersecurity level protection, strengthen network data security protection, establish and improve network data security management systems, adopt technical measures such as encryption, backup, access control, and security certification, and other necessary measures, to protect network data from tampering, destruction, leakage, or illegal acquisition or illegal use, handle network data security incidents, prevent and combat illegal and criminal activities targeting or using network data, and bear primary responsibility for the security of the network data processed.
网络数据处理者提供的网络产品、服务应当符合相关国家标准的强制性要求；发现网络产品、服务存在安全缺陷、漏洞等风险时，应当立即采取补救措施，按照规定及时告知用户并向有关主管部门报告；涉及危害国家安全、公共利益的，网络数据处理者还应当在24小时内向有关主管部门报告。
Network products and services provided by network data processors shall comply with the mandatory requirements of relevant national standards; where risks such as security defects or vulnerabilities are found in network products or services, immediate remedial measures shall be taken, and users shall be promptly informed and reports shall be made to the relevant competent authorities in accordance with regulations; where national security or public interests are involved, the network data processor shall also report to the relevant competent authorities within 24 hours.
网络数据处理者应当建立健全网络数据安全事件应急预案，发生网络数据安全事件时，应当立即启动预案，采取措施防止危害扩大，消除安全隐患，并按照规定向有关主管部门报告。
Network data processors shall establish and improve emergency response plans for network data security incidents. When a network data security incident occurs, they shall immediately activate the plan, take measures to prevent the harm from expanding, eliminate security risks, and report to the relevant competent authorities in accordance with regulations.
网络数据安全事件对个人、组织合法权益造成危害的，网络数据处理者应当及时将安全事件和风险情况、危害后果、已经采取的补救措施等，以电话、短信、即时通信工具、电子邮件或者公告等方式通知利害关系人；法律、行政法规规定可以不通知的，从其规定。网络数据处理者在处置网络数据安全事件过程中发现涉嫌违法犯罪线索的，应当按照规定向公安机关、国家安全机关报案，并配合开展侦查、调查和处置工作。
Where a network data security incident causes harm to the lawful rights and interests of individuals or organizations, the network data processor shall promptly notify the interested parties of the security incident and risk situation, harmful consequences, and remedial measures already taken, by telephone, SMS, instant messaging tools, email, or announcement; where laws or administrative regulations provide that notification may be omitted, such provisions shall prevail. Where the network data processor discovers clues of suspected illegal or criminal activities during the handling of a network data security incident, it shall report to the public security or national security authorities in accordance with regulations and cooperate with the investigation, inquiry, and handling work.
网络数据处理者向其他网络数据处理者提供、委托处理个人信息和重要数据的，应当通过合同等与网络数据接收方约定处理目的、方式、范围以及安全保护义务等，并对网络数据接收方履行义务的情况进行监督。向其他网络数据处理者提供、委托处理个人信息和重要数据的处理情况记录，应当至少保存3年。
Where a network data processor provides or entrusts the processing of personal information and important data to another network data processor, it shall, through contracts or other means, agree with the network data recipient on the purpose, method, scope, and security protection obligations of the processing, and supervise the performance of obligations by the network data recipient. Records of the processing of providing or entrusting the processing of personal information and important data to other network data processors shall be kept for at least 3 years.
网络数据接收方应当履行网络数据安全保护义务，并按照约定的目的、方式、范围等处理个人信息和重要数据。
The network data recipient shall fulfill the network data security protection obligations and process personal information and important data in accordance with the agreed purpose, method, scope, etc.
两个以上的网络数据处理者共同决定个人信息和重要数据的处理目的和处理方式的，应当约定各自的权利和义务。
Where two or more network data processors jointly determine the purpose and method of processing personal information and important data, they shall agree on their respective rights and obligations.
网络数据处理者开展网络数据处理活动，影响或者可能影响国家安全的，应当按照国家有关规定进行国家安全审查。
Where a network data processor conducts network data processing activities that affect or may affect national security, it shall conduct a national security review in accordance with relevant state regulations.
网络数据处理者因合并、分立、解散、破产等原因需要转移网络数据的，网络数据接收方应当继续履行网络数据安全保护义务。
Where a network data processor needs to transfer network data due to merger, division, dissolution, bankruptcy, or other reasons, the network data recipient shall continue to fulfill the network data security protection obligations.
国家机关委托他人建设、运行、维护电子政务系统，存储、加工政务数据，应当按照国家有关规定经过严格的批准程序，明确受托方的网络数据处理权限、保护责任等，监督受托方履行网络数据安全保护义务。
Where a state organ entrusts another party to construct, operate, or maintain an e-government system, or store or process government data, it shall undergo strict approval procedures in accordance with relevant state regulations, clearly define the entrusted party's network data processing authority and protection responsibilities, and supervise the entrusted party's performance of network data security protection obligations.
网络数据处理者为国家机关、关键信息基础设施运营者提供服务，或者参与其他公共基础设施、公共服务系统建设、运行、维护的，应当依照法律、法规的规定和合同约定履行网络数据安全保护义务，提供安全、稳定、持续的服务。
Where a network data processor provides services to state organs or operators of critical information infrastructure, or participates in the construction, operation, or maintenance of other public infrastructure or public service systems, it shall fulfill network data security protection obligations in accordance with laws, regulations, and contractual agreements, and provide safe, stable, and continuous services.
前款规定的网络数据处理者未经委托方同意，不得访问、获取、留存、使用、泄露或者向他人提供网络数据，不得对网络数据进行关联分析。
The network data processor mentioned in the preceding paragraph shall not access, obtain, retain, use, disclose, or provide network data to others without the consent of the entrusting party, nor conduct correlation analysis on network data.
为国家机关提供服务的信息系统应当参照电子政务系统的管理要求加强网络数据安全管理，保障网络数据安全。
Information systems providing services to state organs shall strengthen network data security management by reference to the management requirements for e-government systems, ensuring network data security.
网络数据处理者使用自动化工具访问、收集网络数据，应当评估对网络服务带来的影响，不得非法侵入他人网络，不得干扰网络服务正常运行。
Where a network data processor uses automated tools to access or collect network data, it shall assess the impact on network services, and shall not illegally intrude into others' networks or interfere with the normal operation of network services.
提供生成式人工智能服务的网络数据处理者应当加强对训练数据和训练数据处理活动的安全管理，采取有效措施防范和处置网络数据安全风险。
Network data processors providing generative artificial intelligence services shall strengthen the security management of training data and training data processing activities, and take effective measures to prevent and handle network data security risks.
面向社会提供产品、服务的网络数据处理者应当接受社会监督，建立便捷的网络数据安全投诉、举报渠道，公布投诉、举报方式等信息，及时受理并处理网络数据安全投诉、举报。
Network data processors that provide products or services to the public shall accept social supervision, establish convenient channels for network data security complaints and reports, publish information such as complaint and report methods, and promptly accept and handle network data security complaints and reports.
个人信息保护
Personal Information Protection
网络数据处理者在处理个人信息前，通过制定个人信息处理规则的方式依法向个人告知的，个人信息处理规则应当集中公开展示、易于访问并置于醒目位置，内容明确具体、清晰易懂，包括但不限于下列内容：
Where a network data processor, before processing personal information, informs the individual by formulating personal information processing rules in accordance with the law, the personal information processing rules shall be displayed centrally, easily accessible, and placed in a conspicuous position, with specific, clear, and understandable content, including but not limited to the following:
(一)网络数据处理者的名称或者姓名和联系方式；
(1) The name or title and contact information of the network data processor;
(二)处理个人信息的目的、方式、种类，处理敏感个人信息的必要性以及对个人权益的影响；
(2) The purpose, method, and type of processing personal information, the necessity of processing sensitive personal information, and the impact on individual rights and interests;
(三)个人信息保存期限和到期后的处理方式，保存期限难以确定的，应当明确保存期限的确定方法；
(3) The retention period of personal information and the method of processing after expiration; if the retention period is difficult to determine, the method for determining the retention period shall be clearly stated;
(四)个人查阅、复制、转移、更正、补充、删除、限制处理个人信息以及注销账号、撤回同意的方法和途径等。
(4) The methods and channels for individuals to access, copy, transfer, correct, supplement, delete, restrict the processing of their personal information, cancel accounts, and withdraw consent.
网络数据处理者按照前款规定向个人告知收集和向其他网络数据处理者提供个人信息的目的、方式、种类以及网络数据接收方信息的，应当以清单等形式予以列明。网络数据处理者处理不满十四周岁未成年人个人信息的，还应当制定专门的个人信息处理规则。
Where a network data processor informs individuals of the purpose, method, and type of collecting and providing personal information to other network data processors, as well as the information of the network data recipient, in accordance with the preceding paragraph, it shall list them in the form of a list or similar. Where a network data processor processes the personal information of minors under the age of 14, it shall also formulate special personal information processing rules.
网络数据处理者基于个人同意处理个人信息的，应当遵守下列规定：
Where a network data processor processes personal information based on individual consent, it shall comply with the following provisions:
(一)收集个人信息为提供产品或者服务所必需，不得超范围收集个人信息，不得通过误导、欺诈、胁迫等方式取得个人同意；
(1) The collection of personal information shall be necessary for providing products or services; personal information shall not be collected beyond the scope, and consent shall not be obtained through misleading, fraudulent, coercive, or other means;
(二)处理生物识别、宗教信仰、特定身份、医疗健康、金融账户、行踪轨迹等敏感个人信息的，应当取得个人的单独同意；
(2) Where processing sensitive personal information such as biometrics, religious beliefs, specific identities, medical health, financial accounts, or whereabouts, separate consent from the individual shall be obtained;
(三)处理不满十四周岁未成年人个人信息的，应当取得未成年人的父母或者其他监护人的同意；
(3) Where processing the personal information of minors under the age of 14, the consent of the minor's parents or other guardians shall be obtained;
(四)不得超出个人同意的个人信息处理目的、方式、种类、保存期限处理个人信息；
(4) Personal information shall not be processed beyond the purpose, method, type, or retention period consented to by the individual;
(五)不得在个人明确表示不同意处理其个人信息后，频繁征求同意；
(5) After an individual explicitly indicates refusal to have their personal information processed, consent shall not be repeatedly solicited;
(六)个人信息的处理目的、方式、种类发生变更的，应当重新取得个人同意。
(6) Where the purpose, method, or type of processing personal information changes, consent shall be obtained anew from the individual.
法律、行政法规规定处理敏感个人信息应当取得书面同意的，从其规定。
Where laws or administrative regulations require written consent for processing sensitive personal information, such provisions shall prevail.
个人请求查阅、复制、更正、补充、删除、限制处理其个人信息，或者个人注销账号、撤回同意的，网络数据处理者应当及时受理，并提供便捷的支持个人行使权利的方法和途径，不得设置不合理条件限制个人的合理请求。
Where an individual requests to access, copy, correct, supplement, delete, or restrict the processing of their personal information, or to cancel an account or withdraw consent, the network data processor shall promptly handle the request and provide convenient methods and channels to support the individual's exercise of rights, and shall not impose unreasonable conditions to restrict the individual's reasonable requests.
因使用自动化采集技术等无法避免采集到非必要个人信息或者未依法取得个人同意的个人信息，以及个人注销账号的，网络数据处理者应当删除个人信息或者进行匿名化处理。法律、行政法规规定的保存期限未届满，或者删除、匿名化处理个人信息从技术上难以实现的，网络数据处理者应当停止除存储和采取必要的安全保护措施之外的处理。
Where, due to the use of automated collection technology or other reasons, it is unavoidable to collect unnecessary personal information or personal information without legally obtaining consent, or where an individual cancels an account, the network data processor shall delete the personal information or anonymize it. Where the retention period prescribed by laws or administrative regulations has not expired, or where deletion or anonymization is technically difficult, the network data processor shall cease processing other than storage and necessary security protection measures.
对符合下列条件的个人信息转移请求，网络数据处理者应当为个人指定的其他网络数据处理者访问、获取有关个人信息提供途径：
For a request to transfer personal information that meets the following conditions, the network data processor shall provide a means for the other network data processor designated by the individual to access and obtain the relevant personal information:
(一)能够验证请求人的真实身份；
(1) The true identity of the requester can be verified;
(二)请求转移的是本人同意提供的或者基于合同收集的个人信息；
(2) The requested transfer is of personal information provided by the individual's consent or collected based on a contract;
(三)转移个人信息具备技术可行性；
(3) The transfer of personal information is technically feasible;
(四)转移个人信息不损害他人合法权益。
(4) The transfer of personal information does not harm the lawful rights and interests of others.
请求转移个人信息次数等明显超出合理范围的，网络数据处理者可以根据转移个人信息的成本收取必要费用。
Where the number of requests to transfer personal information significantly exceeds a reasonable range, the network data processor may charge necessary fees based on the cost of transferring the personal information.
中华人民共和国境外网络数据处理者处理境内自然人个人信息，依照《中华人民共和国个人信息保护法》第五十三条规定在境内设立专门机构或者指定代表的，应当将有关机构的名称或者代表的姓名、联系方式等报送所在地设区的市级网信部门；网信部门应当及时通报同级有关主管部门。
Where a network data processor outside the territory of the People's Republic of China processes the personal information of domestic natural persons and establishes a specialized agency or designates a representative within the territory in accordance with Article 53 of the Personal Information Protection Law of the People's Republic of China, it shall submit the name of the agency or the name and contact information of the representative to the municipal cyberspace administration at the place where it is located; the cyberspace administration shall promptly notify the relevant competent authorities at the same level.
网络数据处理者应当定期自行或者委托专业机构对其处理个人信息遵守法律、行政法规的情况进行合规审计。
Network data processors shall periodically conduct compliance audits on their processing of personal information in accordance with laws and administrative regulations, either by themselves or by entrusting professional institutions.
网络数据处理者处理1000万人以上个人信息的，还应当遵守本条例第三十条、第三十二条对处理重要数据的网络数据处理者(以下简称重要数据的处理者)作出的规定。
Where a network data processor processes the personal information of 10 million or more individuals, it shall also comply with the provisions of Articles 30 and 32 of these Regulations concerning network data processors that process important data (hereinafter referred to as processors of important data).
重要数据安全
Important Data Security
国家数据安全工作协调机制统筹协调有关部门制定重要数据目录，加强对重要数据的保护。各地区、各部门应当按照数据分类分级保护制度，确定本地区、本部门以及相关行业、领域的重要数据具体目录，对列入目录的网络数据进行重点保护。
The national data security work coordination mechanism shall coordinate relevant departments to formulate a catalog of important data and strengthen the protection of important data. All regions and departments shall, in accordance with the data classification and grading protection system, determine the specific catalog of important data in their respective regions, departments, and related industries and fields, and provide key protection for network data included in the catalog.
网络数据处理者应当按照国家有关规定识别、申报重要数据。对确认为重要数据的，相关地区、部门应当及时向网络数据处理者告知或者公开发布。网络数据处理者应当履行网络数据安全保护责任。
Network data processors shall identify and declare important data in accordance with relevant state regulations. Where data is confirmed as important data, the relevant region or department shall promptly notify the network data processor or publicly release it. The network data processor shall fulfill the responsibility of network data security protection.
国家鼓励网络数据处理者使用数据标签标识等技术和产品，提高重要数据安全管理水平。
The State encourages network data processors to use technologies and products such as data labeling to improve the level of important data security management.
重要数据的处理者应当明确网络数据安全负责人和网络数据安全管理机构。网络数据安全管理机构应当履行下列网络数据安全保护责任：
Processors of important data shall designate a network data security officer and a network data security management body. The network data security management body shall fulfill the following network data security protection responsibilities:
(一)制定实施网络数据安全管理制度、操作规程和网络数据安全事件应急预案；
(1) Formulate and implement network data security management systems, operating procedures, and emergency response plans for network data security incidents;
(二)定期组织开展网络数据安全风险监测、风险评估、应急演练、宣传教育培训等活动，及时处置网络数据安全风险和事件；
(2) Regularly organize activities such as network data security risk monitoring, risk assessment, emergency drills, and publicity, education, and training, and promptly handle network data security risks and incidents;
(三)受理并处理网络数据安全投诉、举报。
(3) Accept and handle network data security complaints and reports.
网络数据安全负责人应当具备网络数据安全专业知识和相关管理工作经历，由网络数据处理者管理层成员担任，有权直接向有关主管部门报告网络数据安全情况。
The network data security officer shall possess professional knowledge in network data security and relevant management work experience, be appointed from among the management members of the network data processor, and have the right to directly report network data security situations to the relevant competent authorities.
掌握有关主管部门规定的特定种类、规模的重要数据的网络数据处理者，应当对网络数据安全负责人和关键岗位的人员进行安全背景审查，加强相关人员培训。审查时，可以申请公安机关、国家安全机关协助。
Network data processors that hold important data of specific types or scales as specified by the relevant competent authorities shall conduct security background checks on the network data security officer and personnel in key positions, and strengthen relevant personnel training. When conducting checks, they may request assistance from public security or national security authorities.
重要数据的处理者提供、委托处理、共同处理重要数据前，应当进行风险评估，但是属于履行法定职责或者法定义务的除外。
Before providing, entrusting processing, or jointly processing important data, the processor of important data shall conduct a risk assessment, except where it is for the performance of statutory duties or obligations.
风险评估应当重点评估下列内容：
The risk assessment shall focus on the following:
(一)提供、委托处理、共同处理网络数据，以及网络数据接收方处理网络数据的目的、方式、范围等是否合法、正当、必要；
(1) Whether the purpose, method, and scope of providing, entrusting processing, or jointly processing network data, and the processing of network data by the network data recipient, are lawful, legitimate, and necessary;
(二)提供、委托处理、共同处理的网络数据遭到篡改、破坏、泄露或者非法获取、非法利用的风险，以及对国家安全、公共利益或者个人、组织合法权益带来的风险；
(2) The risk of tampering, destruction, leakage, or illegal acquisition or illegal use of the network data provided, entrusted for processing, or jointly processed, and the risk to national security, public interests, or the lawful rights and interests of individuals or organizations;
(三)网络数据接收方的诚信、守法等情况；
(3) The integrity and law-abiding status of the network data recipient;
(四)与网络数据接收方订立或者拟订立的相关合同中关于网络数据安全的要求能否有效约束网络数据接收方履行网络数据安全保护义务；
(4) Whether the requirements concerning network data security in the relevant contract concluded or to be concluded with the network data recipient can effectively bind the network data recipient to fulfill its network data security protection obligations;
(五)采取或者拟采取的技术和管理措施等能否有效防范网络数据遭到篡改、破坏、泄露或者非法获取、非法利用等风险；
(5) Whether the technical and management measures adopted or to be adopted can effectively prevent risks such as tampering, destruction, leakage, or illegal acquisition or illegal use of network data;
(六)有关主管部门规定的其他评估内容。
(6) Other assessment contents specified by the relevant competent authorities.
重要数据的处理者因合并、分立、解散、破产等可能影响重要数据安全的，应当采取措施保障网络数据安全，并向省级以上有关主管部门报告重要数据处置方案、接收方的名称或者姓名和联系方式等；主管部门不明确的，应当向省级以上数据安全工作协调机制报告。
Where a processor of important data may affect the security of important data due to merger, division, dissolution, bankruptcy, or other reasons, it shall take measures to ensure network data security and report to the relevant competent authority at or above the provincial level the plan for handling important data, the name or title and contact information of the recipient, etc.; where the competent authority is unclear, it shall report to the data security work coordination mechanism at or above the provincial level.
重要数据的处理者应当每年度对其网络数据处理活动开展风险评估，并向省级以上有关主管部门报送风险评估报告，有关主管部门应当及时通报同级网信部门、公安机关。
Processors of important data shall conduct a risk assessment of their network data processing activities annually and submit a risk assessment report to the relevant competent authority at or above the provincial level, and the relevant competent authority shall promptly notify the cyberspace administration and public security authorities at the same level.
风险评估报告应当包括下列内容：
The risk assessment report shall include the following:
(一)网络数据处理者基本信息、网络数据安全管理机构信息、网络数据安全负责人姓名和联系方式等；
(1) Basic information of the network data processor, information on the network data security management body, and the name and contact information of the network data security officer;
(二)处理重要数据的目的、种类、数量、方式、范围、存储期限、存储地点等，开展网络数据处理活动的情况，不包括网络数据内容本身；
(2) The purpose, type, quantity, method, scope, storage period, and storage location of processing important data, and the status of network data processing activities, excluding the network data content itself;
(三)网络数据安全管理制度及实施情况，加密、备份、标签标识、访问控制、安全认证等技术措施和其他必要措施及其有效性；
(3) The network data security management system and its implementation, technical measures such as encryption, backup, labeling, access control, and security certification, and other necessary measures and their effectiveness;
(四)发现的网络数据安全风险，发生的网络数据安全事件及处置情况；
(4) Network data security risks discovered, network data security incidents that occurred, and their handling;
(五)提供、委托处理、共同处理重要数据的风险评估情况；
(5) The risk assessment status of providing, entrusting processing, or jointly processing important data;
(六)网络数据出境情况；
(6) The status of network data cross-border transfer;
(七)有关主管部门规定的其他报告内容。
(7) Other report contents specified by the relevant competent authorities.
处理重要数据的大型网络平台服务提供者报送的风险评估报告，除包括前款规定的内容外，还应当充分说明关键业务和供应链网络数据安全等情况。
The risk assessment report submitted by a large online platform service provider that processes important data shall, in addition to the contents specified in the preceding paragraph, fully explain the network data security status of key businesses and supply chains.
重要数据的处理者存在可能危害国家安全的重要数据处理活动的，省级以上有关主管部门应当责令其采取整改或者停止处理重要数据等措施。重要数据的处理者应当按照有关要求立即采取措施。
Where a processor of important data engages in important data processing activities that may endanger national security, the relevant competent authority at or above the provincial level shall order it to take measures such as rectification or cessation of processing important data. The processor of important data shall immediately take measures in accordance with the relevant requirements.
网络数据跨境安全管理
Cross-Border Network Data Security Management
国家网信部门统筹协调有关部门建立国家数据出境安全管理专项工作机制，研究制定国家网络数据出境安全管理相关政策，协调处理网络数据出境安全重大事项。
The national cyberspace administration shall coordinate relevant departments to establish a special working mechanism for national data cross-border security management, study and formulate relevant policies for national network data cross-border security management, and coordinate the handling of major issues concerning network data cross-border security.
符合下列条件之一的，网络数据处理者可以向境外提供个人信息：
Where one of the following conditions is met, a network data processor may provide personal information abroad:
(一)通过国家网信部门组织的数据出境安全评估；
(1) Passing the data cross-border security assessment organized by the national cyberspace administration;
(二)按照国家网信部门的规定经专业机构进行个人信息保护认证；
(2) Obtaining personal information protection certification by a professional institution in accordance with the provisions of the national cyberspace administration;
(三)符合国家网信部门制定的关于个人信息出境标准合同的规定；
(3) Complying with the provisions of the national cyberspace administration on standard contracts for the cross-border transfer of personal information;
(四)为订立、履行个人作为一方当事人的合同，确需向境外提供个人信息；
(4) Necessarily providing personal information abroad for the conclusion or performance of a contract to which the individual is a party;
(五)按照依法制定的劳动规章制度和依法签订的集体合同实施跨境人力资源管理，确需向境外提供员工个人信息；
(5) Necessarily providing employee personal information abroad for cross-border human resource management implemented in accordance with legally formulated labor rules and regulations and legally concluded collective contracts;
(六)为履行法定职责或者法定义务，确需向境外提供个人信息；
(6) Necessarily providing personal information abroad for the performance of statutory duties or obligations;
(七)紧急情况下为保护自然人的生命健康和财产安全，确需向境外提供个人信息；
(7) Necessarily providing personal information abroad in emergency circumstances to protect the life and health or property safety of natural persons;
(八)法律、行政法规或者国家网信部门规定的其他条件。
(8) Other conditions specified by laws, administrative regulations, or the national cyberspace administration.
中华人民共和国缔结或者参加的国际条约、协定对向中华人民共和国境外提供个人信息的条件等有规定的，可以按照其规定执行。
Where international treaties or agreements concluded or acceded to by the People's Republic of China have provisions on the conditions for providing personal information abroad, such provisions may be followed.
网络数据处理者在中华人民共和国境内运营中收集和产生的重要数据确需向境外提供的，应当通过国家网信部门组织的数据出境安全评估。网络数据处理者按照国家有关规定识别、申报重要数据，但未被相关地区、部门告知或者公开发布为重要数据的，不需要将其作为重要数据申报数据出境安全评估。
Where important data collected and generated during operations within the territory of the People's Republic of China by a network data processor truly needs to be provided abroad, it shall pass the data cross-border security assessment organized by the national cyberspace administration. Where a network data processor identifies and declares important data in accordance with relevant state regulations, but the data is not notified or publicly released as important data by the relevant region or department, it does not need to apply for a data cross-border security assessment as important data.
通过数据出境安全评估后，网络数据处理者向境外提供个人信息和重要数据的，不得超出评估时明确的数据出境目的、方式、范围和种类、规模等。
After passing the data cross-border security assessment, the network data processor providing personal information and important data abroad shall not exceed the purpose, method, scope, type, scale, etc., of data cross-border transfer as specified in the assessment.
国家采取措施，防范、处置网络数据跨境安全风险和威胁。任何个人、组织不得提供专门用于破坏、避开技术措施的程序、工具等；明知他人从事破坏、避开技术措施等活动的，不得为其提供技术支持或者帮助。
The State takes measures to prevent and handle cross-border network data security risks and threats. No individual or organization shall provide programs or tools specifically used for destroying or circumventing technical measures; where knowing that others are engaged in activities such as destroying or circumventing technical measures, they shall not provide technical support or assistance.
网络平台服务提供者义务
Obligations of Online Platform Service Providers
网络平台服务提供者应当通过平台规则或者合同等明确接入其平台的第三方产品和服务提供者的网络数据安全保护义务，督促第三方产品和服务提供者加强网络数据安全管理。
Online platform service providers shall, through platform rules or contracts, specify the network data security protection obligations of third-party product and service providers that access their platforms, and urge third-party product and service providers to strengthen network data security management.
预装应用程序的智能终端等设备生产者，适用前款规定。
Producers of smart terminals and other devices with pre-installed applications shall also comply with the provisions of the preceding paragraph.
第三方产品和服务提供者违反法律、行政法规的规定或者平台规则、合同约定开展网络数据处理活动，对用户造成损害的，网络平台服务提供者、第三方产品和服务提供者、预装应用程序的智能终端等设备生产者应当依法承担相应责任。
Where a third-party product or service provider conducts network data processing activities in violation of laws, administrative regulations, or platform rules or contracts, causing harm to users, the online platform service provider, the third-party product or service provider, and the producer of smart terminals or other devices with pre-installed applications shall bear corresponding liability in accordance with the law.
国家鼓励保险公司开发网络数据损害赔偿责任险种，鼓励网络平台服务提供者、预装应用程序的智能终端等设备生产者投保。
The State encourages insurance companies to develop insurance types for network data damage liability, and encourages online platform service providers and producers of smart terminals or other devices with pre-installed applications to purchase insurance.
提供应用程序分发服务的网络平台服务提供者，应当建立应用程序核验规则并开展网络数据安全相关核验。发现待分发或者已分发的应用程序不符合法律、行政法规的规定或者国家标准的强制性要求的，应当采取警示、不予分发、暂停分发或者终止分发等措施。
Online platform service providers that provide application distribution services shall establish application verification rules and conduct network data security-related verification. Where an application to be distributed or already distributed does not comply with laws, administrative regulations, or mandatory requirements of national standards, measures such as warnings, refusal to distribute, suspension of distribution, or termination of distribution shall be taken.
网络平台服务提供者通过自动化决策方式向个人进行信息推送的，应当设置易于理解、便于访问和操作的个性化推荐关闭选项，为用户提供拒绝接收推送信息、删除针对其个人特征的用户标签等功能。
Where an online platform service provider pushes information to individuals through automated decision-making, it shall set up an option to turn off personalized recommendations that is easy to understand, access, and operate, and provide users with functions such as refusing to receive pushed information and deleting user tags based on their personal characteristics.
国家推进网络身份认证公共服务建设，按照政府引导、用户自愿原则进行推广应用。
The State promotes the construction of public services for network identity authentication, and promotes their application based on the principle of government guidance and user voluntariness.
鼓励网络平台服务提供者支持用户使用国家网络身份认证公共服务登记、核验真实身份信息。
Online platform service providers are encouraged to support users in using the national network identity authentication public service to register and verify their true identity information.
大型网络平台服务提供者应当每年度发布个人信息保护社会责任报告，报告内容包括但不限于个人信息保护措施和成效、个人行使权利的申请受理情况、主要由外部成员组成的个人信息保护监督机构履行职责情况等。
Large online platform service providers shall publish an annual social responsibility report on personal information protection, which shall include but not be limited to personal information protection measures and effectiveness, the status of handling individual requests for exercising rights, and the performance of duties by the personal information protection supervision body mainly composed of external members.
大型网络平台服务提供者跨境提供网络数据，应当遵守国家数据跨境安全管理要求，健全相关技术和管理措施，防范网络数据跨境安全风险。
Where large online platform service providers provide network data across borders, they shall comply with national data cross-border security management requirements, improve relevant technical and management measures, and prevent cross-border network data security risks.
大型网络平台服务提供者不得利用网络数据、算法以及平台规则等从事下列活动：
Large online platform service providers shall not use network data, algorithms, or platform rules to engage in the following activities:
(一)通过误导、欺诈、胁迫等方式处理用户在平台上产生的网络数据；
(1) Processing network data generated by users on the platform through misleading, fraudulent, coercive, or other means;
(二)无正当理由限制用户访问、使用其在平台上产生的网络数据；
(2) Without legitimate reasons, restricting users from accessing or using network data generated by them on the platform;
(三)对用户实施不合理的差别待遇，损害用户合法权益；
(3) Imposing unreasonable differential treatment on users, harming their lawful rights and interests;
(四)法律、行政法规禁止的其他活动。
(4) Other activities prohibited by laws or administrative regulations.
监 督 管 理
Supervision and Management
国家网信部门负责统筹协调网络数据安全和相关监督管理工作。
The national cyberspace administration is responsible for coordinating network data security and related supervision and management.
公安机关、国家安全机关依照有关法律、行政法规和本条例的规定，在各自职责范围内承担网络数据安全监督管理职责，依法防范和打击危害网络数据安全的违法犯罪活动。
Public security authorities and national security authorities shall, in accordance with relevant laws, administrative regulations, and these Regulations, undertake network data security supervision and management responsibilities within their respective functions, and prevent and combat illegal and criminal activities that endanger network data security in accordance with the law.
国家数据管理部门在具体承担数据管理工作中履行相应的网络数据安全职责。
The national data management department shall perform corresponding network data security responsibilities in the specific undertaking of data management work.
各地区、各部门对本地区、本部门工作中收集和产生的网络数据及网络数据安全负责。
All regions and departments shall be responsible for the network data and network data security collected and generated in their work.
各有关主管部门承担本行业、本领域网络数据安全监督管理职责，应当明确本行业、本领域网络数据安全保护工作机构，统筹制定并组织实施本行业、本领域网络数据安全事件应急预案，定期组织开展本行业、本领域网络数据安全风险评估，对网络数据处理者履行网络数据安全保护义务情况进行监督检查，指导督促网络数据处理者及时对存在的风险隐患进行整改。
All relevant competent authorities shall undertake the responsibility of network data security supervision and management in their respective industries and fields, designate a working body for network data security protection in their respective industries and fields, coordinate the formulation and implementation of emergency response plans for network data security incidents in their respective industries and fields, regularly organize network data security risk assessments in their respective industries and fields, conduct supervision and inspection of network data processors' performance of network data security protection obligations, and guide and urge network data processors to promptly rectify existing risks and hazards.
国家网信部门统筹协调有关主管部门及时汇总、研判、共享、发布网络数据安全风险相关信息，加强网络数据安全信息共享、网络数据安全风险和威胁监测预警以及网络数据安全事件应急处置工作。
The national cyberspace administration shall coordinate relevant competent authorities to promptly aggregate, assess, share, and publish information related to network data security risks, and strengthen network data security information sharing, network data security risk and threat monitoring and early warning, and emergency response to network data security incidents.
有关主管部门可以采取下列措施对网络数据安全进行监督检查：
Relevant competent authorities may take the following measures to conduct supervision and inspection of network data security:
(一)要求网络数据处理者及其相关人员就监督检查事项作出说明；
(1) Requiring network data processors and their relevant personnel to make explanations on matters subject to supervision and inspection;
(二)查阅、复制与网络数据安全有关的文件、记录；
(2) Inspecting and copying documents and records related to network data security;
(三)检查网络数据安全措施运行情况；
(3) Inspecting the operation of network data security measures;
(四)检查与网络数据处理活动有关的设备、物品；
(4) Inspecting equipment and items related to network data processing activities;
(五)法律、行政法规规定的其他必要措施。
(5) Other necessary measures prescribed by laws or administrative regulations.
网络数据处理者应当对有关主管部门依法开展的网络数据安全监督检查予以配合。
Network data processors shall cooperate with the network data security supervision and inspection conducted by relevant competent authorities in accordance with the law.
有关主管部门开展网络数据安全监督检查，应当客观公正，不得向被检查单位收取费用。
Relevant competent authorities conducting network data security supervision and inspection shall be objective and fair, and shall not charge fees from the inspected units.
有关主管部门在网络数据安全监督检查中不得访问、收集与网络数据安全无关的业务信息，获取的信息只能用于维护网络数据安全的需要，不得用于其他用途。
Relevant competent authorities shall not access or collect business information unrelated to network data security during network data security supervision and inspection; the information obtained may only be used for the needs of maintaining network data security and shall not be used for other purposes.
有关主管部门发现网络数据处理者的网络数据处理活动存在较大安全风险的，可以按照规定的权限和程序要求网络数据处理者暂停相关服务、修改平台规则、完善技术措施等，消除网络数据安全隐患。
Where a relevant competent authority finds that a network data processor's network data processing activities pose a relatively large security risk, it may, in accordance with the prescribed authority and procedures, require the network data processor to suspend relevant services, modify platform rules, improve technical measures, etc., to eliminate network data security hazards.
有关主管部门在开展网络数据安全监督检查时，应当加强协同配合、信息沟通，合理确定检查频次和检查方式，避免不必要的检查和交叉重复检查。
When conducting network data security supervision and inspection, relevant competent authorities shall strengthen coordination and cooperation, information communication, and reasonably determine the frequency and method of inspection, avoiding unnecessary inspections and overlapping or duplicate inspections.
个人信息保护合规审计、重要数据风险评估、重要数据出境安全评估等应当加强衔接，避免重复评估、审计。重要数据风险评估和网络安全等级测评的内容重合的，相关结果可以互相采信。
Personal information protection compliance audits, important data risk assessments, and important data cross-border security assessments shall be coordinated to avoid duplicate assessments or audits. Where the contents of important data risk assessments and cybersecurity level assessments overlap, the relevant results may be mutually accepted.
有关主管部门及其工作人员对在履行职责中知悉的个人隐私、个人信息、商业秘密、保密商务信息等网络数据应当依法予以保密，不得泄露或者非法向他人提供。
Relevant competent authorities and their staff shall keep confidential the personal privacy, personal information, trade secrets, confidential business information, and other network data learned in the performance of their duties, and shall not disclose or illegally provide them to others.
境外的组织、个人从事危害中华人民共和国国家安全、公共利益，或者侵害中华人民共和国公民的个人信息权益的网络数据处理活动的，国家网信部门会同有关主管部门可以依法采取相应的必要措施。
Where an organization or individual outside the territory engages in network data processing activities that endanger the national security or public interests of the People's Republic of China, or infringe upon the personal information rights and interests of citizens of the People's Republic of China, the national cyberspace administration, together with relevant competent authorities, may take corresponding necessary measures in accordance with the law.
法 律 责 任
Legal Liability
违反本条例第十二条、第十六条至第二十条、第二十二条、第四十条第一款和第二款、第四十一条、第四十二条规定的，由网信、电信、公安等主管部门依据各自职责责令改正，给予警告，没收违法所得；拒不改正或者情节严重的，处100万元以下罚款，并可以责令暂停相关业务、停业整顿、吊销相关业务许可证或者吊销营业执照，对直接负责的主管人员和其他直接责任人员可以处1万元以上10万元以下罚款。
Where the provisions of Articles 12, 16 to 20, 22, 40(1) and (2), 41, or 42 are violated, the competent authorities such as cyberspace, telecommunications, and public security shall, within their respective functions, order correction, give a warning, and confiscate illegal gains; if correction is refused or the circumstances are serious, a fine of not more than 1 million yuan shall be imposed, and the relevant business may be suspended, the business may be ordered to suspend operations for rectification, the relevant business license may be revoked, or the business license may be revoked; the directly responsible supervisor and other directly responsible personnel may be fined not less than 10,000 yuan but not more than 100,000 yuan.
违反本条例第十三条规定的，由网信、电信、公安、国家安全等主管部门依据各自职责责令改正，给予警告，可以并处10万元以上100万元以下罚款，对直接负责的主管人员和其他直接责任人员可以处1万元以上10万元以下罚款；拒不改正或者情节严重的，处100万元以上1000万元以下罚款，并可以责令暂停相关业务、停业整顿、吊销相关业务许可证或者吊销营业执照，对直接负责的主管人员和其他直接责任人员处10万元以上100万元以下罚款。
Where the provisions of Article 13 are violated, the competent authorities such as cyberspace, telecommunications, public security, and national security shall, within their respective functions, order correction, give a warning, and may concurrently impose a fine of not less than 100,000 yuan but not more than 1 million yuan; the directly responsible supervisor and other directly responsible personnel may be fined not less than 10,000 yuan but not more than 100,000 yuan; if correction is refused or the circumstances are serious, a fine of not less than 1 million yuan but not more than 10 million yuan shall be imposed, and the relevant business may be suspended, the business may be ordered to suspend operations for rectification, the relevant business license may be revoked, or the business license may be revoked; the directly responsible supervisor and other directly responsible personnel shall be fined not less than 100,000 yuan but not more than 1 million yuan.
违反本条例第二十九条第二款、第三十条第二款和第三款、第三十一条、第三十二条规定的，由网信、电信、公安等主管部门依据各自职责责令改正，给予警告，可以并处5万元以上50万元以下罚款，对直接负责的主管人员和其他直接责任人员可以处1万元以上10万元以下罚款；拒不改正或者造成大量数据泄露等严重后果的，处50万元以上200万元以下罚款，并可以责令暂停相关业务、停业整顿、吊销相关业务许可证或者吊销营业执照，对直接负责的主管人员和其他直接责任人员处5万元以上20万元以下罚款。
Where the provisions of Article 29(2), Article 30(2) and (3), Article 31, or Article 32 are violated, the competent authorities such as cyberspace, telecommunications, and public security shall, within their respective functions, order correction, give a warning, and may concurrently impose a fine of not less than 50,000 yuan but not more than 500,000 yuan; the directly responsible supervisor and other directly responsible personnel may be fined not less than 10,000 yuan but not more than 100,000 yuan; if correction is refused or serious consequences such as large-scale data leakage occur, a fine of not less than 500,000 yuan but not more than 2 million yuan shall be imposed, and the relevant business may be suspended, the business may be ordered to suspend operations for rectification, the relevant business license may be revoked, or the business license may be revoked; the directly responsible supervisor and other directly responsible personnel shall be fined not less than 50,000 yuan but not more than 200,000 yuan.
违反本条例其他有关规定的，由有关主管部门依照《中华人民共和国网络安全法》、《中华人民共和国数据安全法》、《中华人民共和国个人信息保护法》等法律的有关规定追究法律责任。
Where other provisions of these Regulations are violated, the relevant competent authorities shall pursue legal liability in accordance with the provisions of the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, the Personal Information Protection Law of the People's Republic of China, and other laws.
网络数据处理者存在主动消除或者减轻违法行为危害后果、违法行为轻微并及时改正且没有造成危害后果或者初次违法且危害后果轻微并及时改正等情形的，依照《中华人民共和国行政处罚法》的规定从轻、减轻或者不予行政处罚。
Where a network data processor proactively eliminates or mitigates the harmful consequences of the illegal act, the illegal act is minor and promptly corrected without causing harmful consequences, or the illegal act is a first-time offense with minor harmful consequences and promptly corrected, the punishment shall be mitigated, reduced, or exempted in accordance with the provisions of the Administrative Penalty Law of the People's Republic of China.
国家机关不履行本条例规定的网络数据安全保护义务的，由其上级机关或者有关主管部门责令改正；对直接负责的主管人员和其他直接责任人员依法给予处分。
Where a state organ fails to fulfill the network data security protection obligations stipulated in these Regulations, its superior organ or the relevant competent authority shall order correction; the directly responsible supervisor and other directly responsible personnel shall be given sanctions in accordance with the law.
违反本条例规定，给他人造成损害的，依法承担民事责任；构成违反治安管理行为的，依法给予治安管理处罚；构成犯罪的，依法追究刑事责任。
Where a violation of these Regulations causes harm to others, civil liability shall be borne in accordance with the law; if it constitutes a violation of public security administration, public security administration penalties shall be imposed in accordance with the law; if it constitutes a crime, criminal liability shall be pursued in accordance with the law.
附 则
Supplementary Provisions
本条例下列用语的含义：
For the purposes of these Regulations, the following terms have the meanings ascribed to them:
(一)网络数据，是指通过网络处理和产生的各种电子数据。
(1) "Network data" means various electronic data processed and generated through networks.
(二)网络数据处理活动，是指网络数据的收集、存储、使用、加工、传输、提供、公开、删除等活动。
(2) "Network data processing activities" means activities such as the collection, storage, use, processing, transmission, provision, disclosure, and deletion of network data.
(三)网络数据处理者，是指在网络数据处理活动中自主决定处理目的和处理方式的个人、组织。
(3) "Network data processor" means an individual or organization that independently determines the purpose and method of processing in network data processing activities.
(四)重要数据，是指特定领域、特定群体、特定区域或者达到一定精度和规模，一旦遭到篡改、破坏、泄露或者非法获取、非法利用，可能直接危害国家安全、经济运行、社会稳定、公共健康和安全的数据。
(4) "Important data" means data in specific fields, specific groups, specific regions, or of a certain precision and scale that, if tampered with, destroyed, leaked, or illegally obtained or used, may directly endanger national security, economic operation, social stability, public health, or safety.
(五)委托处理，是指网络数据处理者委托个人、组织按照约定的目的和方式开展的网络数据处理活动。
(5) "Entrusted processing" means network data processing activities conducted by a network data processor entrusting an individual or organization to process data in accordance with an agreed purpose and method.
(六)共同处理，是指两个以上的网络数据处理者共同决定网络数据的处理目的和处理方式的网络数据处理活动。
(6) "Joint processing" means network data processing activities where two or more network data processors jointly determine the purpose and method of processing network data.
(七)单独同意，是指个人针对其个人信息进行特定处理而专门作出具体、明确的同意。
(7) "Separate consent" means specific and explicit consent given by an individual specifically for a particular processing of their personal information.
(八)大型网络平台，是指注册用户5000万以上或者月活跃用户1000万以上，业务类型复杂，网络数据处理活动对国家安全、经济运行、国计民生等具有重要影响的网络平台。
(8) "Large online platform" means an online platform with 50 million or more registered users or 10 million or more monthly active users, with complex business types, and whose network data processing activities have a significant impact on national security, economic operation, or the national economy and people's livelihood.
开展核心数据的网络数据处理活动，按照国家有关规定执行。
Network data processing activities involving core data shall be carried out in accordance with relevant state regulations.
自然人因个人或者家庭事务处理个人信息的，不适用本条例。
These Regulations do not apply to the processing of personal information by natural persons for personal or family affairs.
开展涉及国家秘密、工作秘密的网络数据处理活动，适用《中华人民共和国保守国家秘密法》等法律、行政法规的规定。
Network data processing activities involving state secrets or work secrets shall be governed by the Law of the People's Republic of China on Guarding State Secrets and other laws and administrative regulations.
本条例自2025年1月1日起施行。
These Regulations shall come into effect on January 1, 2025.