China has introduced new measures aimed at strengthening the governance of network data security as its digital economy increasingly depends on data as a strategic resource and a key driver of innovation. The regulations, announced on June 18 and set to take effect on August 20, establish a comprehensive framework for the identification, analysis, and evaluation of risks associated with network data and data-processing activities.
The new rules mandate that handlers of important data conduct annual risk assessments, while encouraging organizations managing general data to carry out evaluations at least once every three years. They also clarify the respective responsibilities of regulators, enterprises, and third-party assessment institutions in maintaining data security standards.
Since the implementation of the Data Security Law in 2021 and subsequent regulations on network data security management, China has progressively developed an extensive system to govern data resources. However, experts noted a gap in the ability of enterprises to proactively identify data risks before incidents occur. These latest measures aim to institutionalize risk assessment as a routine practice, shifting the focus of governance from reactive response to preventive risk management and early warning.
The expansion of advanced technologies such as artificial intelligence, cloud computing, industrial internet platforms, and cross-border data flows has added complexity to data governance. As these digital technologies have become integral to multiple sectors, unaddressed data risks could potentially escalate into significant economic and social challenges. The new regulatory framework is therefore seen as an institutional safeguard supporting the sustained and high-quality development of these sectors.
Industries processing vast quantities of important data—including telecommunications, finance, energy, transportation, healthcare, and industrial manufacturing—are expected to experience immediate impacts. These sectors will need to enhance internal controls, refine data inventories, improve data classification systems, and strengthen continuous monitoring throughout the data lifecycle. While implementation may increase compliance costs in the short term, the measures are designed to bolster resilience against cyberattacks, data breaches, and operational disruptions over the long haul.
The regulations also open avenues for growth within China’s cybersecurity and compliance service industries by allowing enterprises to engage qualified third-party institutions for conducting risk assessments. This development is likely to boost demand for professional services such as risk evaluation, auditing, consulting, certification, and security technology solutions. The establishment of a more standardized assessment ecosystem is expected to support specialized service providers and encourage innovation in data protection technologies.
Authorities emphasize that these measures do not tighten restrictions on data usage but reflect China’s responsible approach to balancing economic development with security. The goal is to foster a more predictable and trustworthy environment where data can be safely developed, shared, and utilized. By clarifying assessment procedures and reducing regulatory uncertainty, the rules aim to lower compliance burdens for many businesses while reinforcing confidence in data-driven innovation.
As data security becomes increasingly intertwined with economic security, social stability, and national competitiveness, China views the implementation of robust risk management mechanisms as essential. These latest measures represent a significant advancement in the country’s efforts to modernize its data governance framework, prioritizing proactive risk assessment to underpin the sustainable growth of its digital economy.