Information date: 20 October 2026 — The Cybersecurity Law governs network operators, network security obligations and incident reporting, while the Data Security Law governs data classification, important-data handling and a broader set of data-processing duties; both were amended in 2025 to align with the Administrative Penalty Law, and both carry tiered penalties that escalate sharply where a serious incident or a refusal to remediate is involved. Knowing that statement is not enough for an operating, research or compliance decision. The team must first establish who and what it applies to, how the effect reaches the real process, and which evidence would justify action.
Verified facts and scope
The Cybersecurity Law governs network operators, network security obligations and incident reporting, while the Data Security Law governs data classification, important-data handling and a broader set of data-processing duties; both were amended in 2025 to align with the Administrative Penalty Law, and both carry tiered penalties that escalate sharply where a serious incident or a refusal to remediate is involved.
Determine first which regime binds you: a network operator with no important data falls mainly under the CSL, while handling of important data or large-volume personal information brings in the DSL and PIPL as well; also check whether the entity is a critical information infrastructure operator, which adds dedicated security management personnel and annual assessment duties.
How the effect reaches operations
The two laws are layered rather than alternative: the same incident can be assessed as a network security failure under the CSL and as a data-security failure under the DSL, and penalties are set by reference to the classification of the data and the consequences rather than to a fixed schedule. Extraterritorial reach attaches to processing activity that occurs outside China but harms national security or the public interest domestically, which is why offshore entities handling China-origin data can be in scope.
The standard misjudgement is assuming that because no personal information was breached, only the CSL applies. Another is treating incident reporting as a single notification: reporting duties differ in trigger, recipient and timing between the network-security and data-security tracks, and late notification is penalised independently of the underlying incident.
For “Comparison: China's Amended Cybersecurity Law vs the Data Security Law — Penalty Tiers, Extraterritorial Reach and Breach Reporting”, official rules or published findings, direct evidence from the relevant product or process, and assumptions that remain untested should be recorded separately. A broad source defines the external boundary; it does not replace batch records, protocols, contracts, labels or direct observations.
Decision
If you hold China-origin data but classify none of it as important data, document that classification decision with the basis, and run CSL incident procedures. If any data set might be important data, treat the DSL duties as primary and build the reporting chain to cover both tracks before an incident, not during one.
Implementation checklist
- Document the data classification decision and the basis for it.
- Write one incident playbook covering both reporting tracks and their separate triggers.
- Assign named security personnel and record the annual assessment where CIIO status applies.
- Assign one decision owner, one implementation owner and a dated review point for “Comparison: China's Amended Cybersecurity Law vs the Data Security Law — Penalty Tiers, Extraterritorial Reach and Breach Reporting”.
- For “Comparison: China's Amended Cybersecurity Law vs the Data Security Law — Penalty Tiers, Extraterritorial Reach and Breach Reporting”, archive the source page, access date, applicable population or entity, and internal evidence both supporting and opposing the current decision.
- When a rule, formulation, supplier, protocol or observed result changes, reopen only the affected question in “Comparison: China's Amended Cybersecurity Law vs the Data Security Law — Penalty Tiers, Extraterritorial Reach and Breach Reporting”.
Evidence and review
For “Comparison: China's Amended Cybersecurity Law vs the Data Security Law — Penalty Tiers, Extraterritorial Reach and Breach Reporting”, start with one real case rather than an abstract checklist. Record the input version, responsible owner, start time, observed result and stop condition. If the team cannot complete “Document the data classification decision and the basis for it.” with current evidence, it should not expand the process to more products, patients, suppliers or markets. The first review should focus only on facts capable of changing the decision.
The second control follows “Write one incident playbook covering both reporting tracks and their separate triggers.”. Keep the source date, applicable population or entity, deadline, cost effect and owner in the same evidence file. A wording preference does not justify a new version. A repeated discrepancy, an unsupported health claim or a regulatory mismatch does: correct that point and hold release until the evidence is available.
After “Assign named security personnel and record the annual assessment where CIIO status applies.”, compare the intended outcome with what actually happened. Apply the same success criteria to each later expansion. If only one number, date or responsibility changes, update that field and the affected conclusion instead of recreating evidence that remains valid. This keeps the decision traceable without turning review into an open-ended rewrite cycle.
Limits of the conclusion
This compares statutory frameworks and is not a legal opinion; the amended texts, implementing rules and local enforcement practice should be checked against the current official versions before relying on any penalty figure.
