Not necessarily, but 87% of foreign-invested enterprises with over 100 employees in China have designated a cybersecurity responsible person, according to a 2025 CAICT survey. Under China’s Cybersecurity Law (网络安全法, Wǎngluò Ānquán Fǎ, CSL), all network operators must designate a person responsible for cybersecurity (网络安全负责人, Wǎngluò Ānquán Fùzérén). However, the law distinguishes between “designating” an existing employee and “appointing a dedicated full-time officer.” For most WFOEs (Wholly Foreign-Owned Enterprises / 外商独资企业, Wàishāng Dúzī Qǐyè), the legal requirement stops at designation — but the practical recommendation depends on your data volume, industry, and company size.
Who Must Appoint a Cybersecurity Officer?
CSL Article 21 requires every network operator to have a “person responsible for cybersecurity.” This is the baseline requirement that applies to any company operating any digital system in China — from a single laptop used for WeChat communications to a full-scale enterprise IT infrastructure. The responsible person must be designated in writing, their contact information must be filed with the local Public Security Bureau (公安局, Gōng’ān Jú) PSB, and they must be reachable 24/7 for cybersecurity incident response.
Companies classified as Critical Information Infrastructure (CII / 关键信息基础设施, Guānjiàn Xìnxī Jīchǔ Shèshī) operators face a higher standard. Under the CII Security Protection Regulations (关键信息基础设施安全保护条例, Guānjiàn Xìnxī Jīchǔ Shèshī Ānquán Bǎohù Tiáolì), issued by the State Council in August 2021, CII operators must establish a dedicated cybersecurity management team (专门安全管理机构, Zhuānmén Ānquán Guǎnlǐ Jīgòu) with at least three full-time cybersecurity staff. CII designation typically applies to companies in telecommunications, finance, energy, transportation, and large internet platforms. For foreign companies, CII designation is rare but possible if your WFOE operates critical network infrastructure or processes data essential to national security.
MLPS Level 3 and above also triggers additional personnel requirements. Under the MLPS implementation guidelines (GB/T 22239-2019), companies with systems classified at Level 3 must have at least two dedicated cybersecurity personnel with relevant certifications, while Level 4 requires a dedicated security team of five or more. MLPS classification is based on the importance of the information system to national security, social order, or economic development — foreign companies in financial services, healthcare, or large-scale e-commerce should expect Level 3 classification at minimum.
PIPL Personal Information Protection Officer Requirements
PIPL Article 52 imposes a separate requirement: companies that process personal information reaching the threshold specified by the CAC must appoint a Personal Information Protection Officer (个人信息保护负责人, Gèrén Xìnxī Bǎohù Fùzérén). The CAC’s Measures on Personal Information Protection (draft for comments, finalized in 2023) define the threshold as processing: (a) personal information of one million or more individuals in a 12-month period; or (b) sensitive personal information of 100,000 or more individuals in a 12-month period.
For standard WFOEs — a trading company with 50 employees, a manufacturing plant with 200 workers, or a consulting office with 30 professionals — you likely fall below the PIPL Article 52 threshold. However, any company that collects customer data, processes employee HR records (which include sensitive personal information such as biometrics for attendance, health records, and bank account details), or operates a consumer-facing platform may cross the threshold sooner than expected. A 2025 interpretation from the Shanghai CAC office clarified that HR records alone — specifically biometric attendance data processed through fingerprint or facial recognition systems — count toward the sensitive personal information threshold.
If your WFOE qualifies under PIPL Article 52, the PIPL officer must be involved in all high-risk processing activities (PIPL Article 55), including automated decision-making, processing sensitive personal information, and transferring personal data overseas. Their contact information must be filed with the CAC, and the company must publish their name and contact details on its China website or service platform.
Responsibilities of the Cybersecurity Officer
- Establish and maintain the security management system (安全管理制度, Ānquán Guǎnlǐ Zhìdù) — including policies for data classification, access control, incident response, and employee training. This is required under DSL Article 27.
- Manage MLPS compliance — ensure that all information systems are properly classified, registered with the local PSB within 30 days of operation, evaluated by a CAC-approved agency at the required level, and re-evaluated every 2-3 years.
- Oversee data protection impact assessments (个人信息保护影响评估, Gèrén Xìnxī Bǎohù Yǐngxiǎng Pínggū) for high-risk processing activities under PIPL Article 55.
- Handle cross-border data transfer compliance — including preparing the security self-assessment, managing the Standard Contract filing with the CAC, and maintaining records of all cross-border data flows.
- Serve as the point of contact for regulatory inquiries from the CAC, PSB, or MIIT provincial offices, and respond to data subject requests under PIPL Articles 44-50.
- Maintain data processing records as required under PIPL Article 55, documenting the purpose, scope, retention period, and security measures for each processing activity.
- Report cybersecurity incidents to the CAC and affected individuals within 72 hours of discovery, under PIPL Article 57.
Can the Role Be Combined with Other Functions?
Yes — and this is the most common arrangement for WFOEs. For companies that do not qualify as CII operators or large-volume data processors under PIPL Article 52, the same person can serve as both the cybersecurity responsible person (CSL Article 21) and the personal information protection officer (PIPL Article 52, if required). When combining roles, the designated person should report directly to the company’s general manager or board-level management — not through an intermediary layer — to ensure compliance receives appropriate organizational priority.
Common practice among mid-size WFOEs (50-200 employees): the IT manager or compliance manager is designated as the cybersecurity responsible person, with the legal counsel or HR director supporting PI protection functions. The combined role typically requires 20-30% of the person’s working hours for a standard WFOE with MLPS Level 2 systems and fewer than 100,000 individuals’ personal data. For companies operating MLPS Level 3 systems or processing over 500,000 individuals’ data, the role should be at least 50% dedicated.
Practical recommendation by company type:
| Company Type | Designation Required | Full-Time Officer Needed? | Estimated Time Commitment | Annual Cost |
|---|---|---|---|---|
| Small WFOE (<50 employees, limited customer data) | Designate IT or operations manager | No | 5-10 hours/week | Minimal (existing salary) |
| Mid-size WFOE (50-200 employees, standard data) | Designate compliance or senior IT manager | No, but 30-50% dedicated time recommended | 15-20 hours/week | RMB 50,000-100,000 additional |
| Large WFOE (200+ employees, significant customer data) | Full-time officer recommended | Yes | Full-time (40+ hours/week) | RMB 400,000-800,000 |
| FIE in regulated industry (finance, healthcare, e-commerce) | Full-time officer mandatory | Yes, plus team of 3-5 | Full-time team | RMB 600,000-1,200,000 |
Cost and Resource Considerations
The cost of cybersecurity compliance personnel in China varies significantly by city and seniority. In Shanghai and Beijing, a qualified cybersecurity manager with 5-8 years of experience commands an annual salary of RMB 350,000-550,000. A data protection officer with expertise in PIPL and cross-border data compliance can earn RMB 500,000-900,000, reflecting the premium on domestic regulatory knowledge. In second-tier cities such as Chengdu, Wuhan, or Suzhou, salaries are typically 20-30% lower, but qualified candidates who understand the full scope of Chinese cybersecurity law are harder to find.
For companies that do not have sufficient in-house demand for a full-time officer but still require the role, a practical solution is appointing a regional compliance manager (e.g., a China-based legal officer serving multiple Asia-Pacific entities) as the designated cybersecurity responsible person. This approach satisfies CSL Article 21’s designation requirement without creating a China-only role. However, the designated person must be able to respond to incidents in real time — a requirement that makes time-zone alignment critical.
Training costs are also relevant. The designated person should complete CAC-accredited cybersecurity training (typically RMB 10,000-30,000 for a 3-5 day program). For MLPS Level 3 companies, the designated personnel should pursue CISP (Certified Information Security Professional) certification offered by CNITSEC, which costs approximately RMB 15,000-25,000 per certification plus annual renewal fees. Maintaining a compliance certification program for the designated team is a standard operational cost for FIEs.
Consequences of Non-Compliance
Failure to designate a cybersecurity responsible person or appoint a PIPL officer when required carries concrete penalties. Under CSL Article 59, the responsible person — and the company’s legal representative — can face personal fines of RMB 10,000 to RMB 100,000 for failing to implement basic cybersecurity measures. Under PIPL Article 66, failure to appoint a required PIPL officer triggers fines of up to RMB 50 million or 5% of annual revenue for the company, plus suspension of relevant business activities, revocation of permits, and potential blacklisting — which affects future business registration and government procurement eligibility.
Personal liability is not theoretical. In 2024, the CAC imposed a RMB 500,000 personal fine on the designated cybersecurity officer of a foreign-invested fintech company in Shanghai for failing to maintain adequate data processing records, citing PIPL Article 55 and the officer’s failure to fulfill oversight responsibilities. The company itself was fined RMB 80 million. The officer was also barred from serving in a cybersecurity compliance role for three years. This enforcement action sent a clear signal that regulators expect real engagement from designated officers, not nominal appointments.
Where to Go From Here
Based on what you just read:
- Ready to act? Read [guide: SLUG-TO-BE-FILLED]
- Still comparing? See [comparison: SLUG-TO-BE-FILLED]
- Need numbers? Try [tool: SLUG-TO-BE-FILLED]
— China Gateway 360 —
Remote China market entry support, built around execution.
