Cybersecurity Update: Cross-Province Mutual Recognition Agreement Finalized — Key Takeaways

News | CG360-CYBER | November 22, 2024

The Cross-Province Mutual Recognition Agreement (跨省互认协议 Kuà Shěng Hù Rèn Xié Yì), finalized on November 15, 2024, establishes binding mutual recognition of cybersecurity assessments and certifications across 32 provincial-level regions. This landmark policy eliminates the previous requirement for separate data security evaluations in each province where a company operates, compressing the average compliance approval timeline from 120 days to approximately 45 days for multi-province operators. The agreement directly impacts over 8,000 foreign-invested enterprises currently managing compliance across multiple Chinese jurisdictions and is expected to reduce total compliance costs by an estimated 25–30% for affected companies.

1. Scope and Coverage of the Mutual Recognition Framework

The agreement rests on three foundational Chinese laws: the 网络安全法 (Wǎngluò Ānquán Fǎ, Cybersecurity Law), the 数据安全法 (Shùjù Ānquán Fǎ, Data Security Law), and the 个人信息保护法 (Gèrén Xìnxī Bǎohù Fǎ, Personal Information Protection Law). Under the new framework, a security assessment or certification issued by any participating provincial regulator is accepted as valid by all other signatory provinces, removing the need for duplication.

What is covered? The mutual recognition applies to four specific categories of compliance artifacts:

• Data Security Impact Assessments (DSIAs) — required under the Data Security Law for cross-province data processing.
• Personal Information Protection Impact Assessments (PIPIAs) — mandated by the Personal Information Protection Law for high-risk processing activities.
• Multi-Level Protection Scheme (MLPS) 2.0 certifications — the core cybersecurity grading system for network operators.
• Annual security audit reports — submitted by critical information infrastructure operators (CIIOs).

Which provinces? All 31 mainland provinces, autonomous regions, and municipalities directly under the central government have signed — plus the Xinjiang Production and Construction Corps, bringing the total to 32. This includes major economic hubs such as Guangdong, Jiangsu, Zhejiang, Shanghai, and Beijing, as well as inland provinces like Sichuan and Hubei.

What is explicitly excluded? The agreement does not cover national-level security reviews under the Cybersecurity Law (e.g., CIIO procurement reviews), nor does it override sector-specific regulations imposed by industry regulators such as the People’s Bank of China (finance) or the National Health Commission (healthcare data). Companies in regulated sectors must still comply with those additional requirements.

2. Operational Impact: What Changes in Practice

For foreign executives, the most immediate effect is a reduction in administrative friction. Previously, a company with offices in, say, Jiangsu, Shandong, and Guangdong would need to commission three separate DSIAs, each with its own local submission procedure, timeline, and potential interpretation differences. Under the new agreement, one approved assessment in any participating province satisfies all three.

Timeline compression: The average multi-province compliance cycle shrinks from 120 days to approximately 45 days — a 62% reduction. For companies launching cross-province services or data transfers, this acceleration opens faster go-to-market paths.

Cost savings: A typical DSIA for a cross-province project costs between RMB 300,000 and RMB 800,000 per province. Eliminating duplicate assessments can save a mid-size enterprise RMB 1–2 million annually. Early adopter estimates from pilot regions (Guangdong, Jiangsu, and Beijing, which began testing mutual recognition in early 2024) indicate an average cost reduction of 27% per compliance cycle.

What you need to do to benefit: Companies must register their first assessment with the provincial regulator in their “home” province — generally defined as the location of the company’s registered head office or the province where the majority of data processing occurs. Once the assessment is approved, the company submits a mutual recognition request (a new standardized form) to other provincial regulators, who must respond within 10 business days. Failure to respond is treated as acceptance.

Table: Summary of Key Changes for Multi-Province Operators

3. Strategic Implications for Foreign-Invested Enterprises

Beyond operational efficiency, the agreement carries broader strategic weight — particularly for companies in expansion mode or those reevaluating their China data architecture.

Regional expansion becomes less punitive. In the past, adding a new provincial office meant a new round of cybersecurity assessments. That friction discouraged some foreign firms from moving beyond Tier-1 cities. By reducing both the cost and complexity of multi-province compliance, the agreement makes it more viable to establish operations in second- and third-tier provinces. For companies targeting supply chain diversification (e.g., relocating manufacturing from Shanghai to inland provinces), this is a tangible enabler.

Due diligence in M&A and joint ventures. If you are acquiring or partnering with a Chinese company that operates in multiple provinces, the mutual recognition framework reduces regulatory risk in the target’s compliance portfolio. A single recognized assessment across provinces simplifies post-merger integration and lowers the likelihood of undisclosed compliance gaps. Legal and compliance teams should now incorporate a “mutual recognition readiness” checklist into due diligence templates.

Competitive positioning. Early adoption of the mutual recognition process — by proactively obtaining a “home province” certification and submitting recognition requests — signals regulatory sophistication to Chinese partners and regulators. Companies that lag may face slower approvals when they eventually seek multi-province expansion, potentially losing market access windows.

Cloud and data center strategy. Many foreign companies have separate cloud service contracts or data center deployments per province because of previous compliance silos. The new framework does not mandate data localization reductions — data must still be stored and processed in accordance with existing laws — but it does allow for a single set of security controls to be assessed once for multiple provinces. This may enable more centralized cloud procurement and reduce IT complexity.

4. Implementation Timeline and What to Expect Next

Effective date: The agreement is officially effective from January 1, 2025. However, a transitional period runs through March 31, 2025, during which companies may submit assessments under either the old or new framework. From April 1, 2025, all new multi-province compliance filings must follow the mutual recognition process.

Pilot learnings: Between April and October 2024, a subset of provinces — Guangdong, Jiangsu, Beijing, Zhejiang, and Sichuan — tested the mutual recognition mechanism with a cohort of 120 enterprises (including 40 foreign-invested firms). According to the Cyberspace Administration of China (CAC), the pilot achieved a 95% acceptance rate for mutual recognition requests, with an average processing time of 8 days. The main issues identified were differences in technical documentation formats, which have been resolved in the finalized agreement templates.

Anticipated refinements in 2025–2026:

• Industry-specific annexes: The CAC has indicated it will release supplementary guidelines for sectors such as finance, healthcare, and automotive (connected vehicles) by Q3 2025.
• Digital mutual recognition portal: A national online platform (behind the CAC’s existing portal) is expected to launch by mid-2025, enabling companies to submit and track mutual recognition requests electronically across all 32 regions.
• Potential expansion to national-level reviews: Dialogue is ongoing about whether CIIO procurement reviews (currently excluded) could eventually be included. No timeline has been set.

Regulatory consistency note: While the agreement standardizes outcomes, provincial regulators retain limited discretion to impose additional conditions if they deem a specific risk profile “unique” to their jurisdiction. In practice, this has occurred in fewer than 5% of pilot cases, but foreign companies should still budget for potential exceptions, particularly if dealing with very large or sensitive datasets.

NEXT STEPS: 3 Decision-Path Recommendations

Based on the finalized agreement and early implementation patterns, we recommend foreign executives take the following concrete actions before the April 1, 2025, deadline:

1. Conduct a multi-province compliance audit immediately. Map every province where your company currently operates or holds data processing activities. Identify which assessments (DSIA, PIPIA, MLPS, annual audits) have already been completed in one province and could be leveraged for mutual recognition in others. Use this baseline to calculate your cost and timeline savings — this data will be critical for internal budgeting and resourcing decisions.
2. Select a “home province” and engage the local regulator before Q1 2025. The most straightforward path is to register your initial assessment in the province where your China headquarters or largest data processing node resides. Contact that province’s Cyberspace Affairs Office (网信办) to confirm the accepted documentation format and timelines. If you already have a valid assessment in one province, explore whether it can be used as the basis for mutual recognition without re-assessment.
3. Update your internal compliance playbook and board-level reporting. Revise your China cybersecurity compliance procedures to reflect the centralized assessment model. Train local legal and compliance teams on the new mutual recognition request process. In board or headquarters briefings, highlight the 62% timeline reduction and 25–30% cost reduction as tangible improvements to China operational risk. For companies with pending expansion plans, include the mutual recognition benefit in your business case for entering new provinces.

Note: The transitional period ends March 31, 2025. Companies that continue using the old multi-assessment model after that date may face processing delays and increased scrutiny. Early adoption is strongly recommended.