{"id":4151,"date":"2026-06-22T16:00:15","date_gmt":"2026-06-22T14:00:15","guid":{"rendered":"https:\/\/lome.legal\/digital-regulations-in-china-in-2026-changes-in-cybersecurity-data-protection-and-ai\/"},"modified":"2026-08-08T15:03:05","modified_gmt":"2026-08-08T13:03:05","slug":"digital-regulations-in-china-in-2026-changes-in-cybersecurity-data-protection-and-ai","status":"publish","type":"post","link":"https:\/\/lome.legal\/en\/digital-regulations-in-china-in-2026-changes-in-cybersecurity-data-protection-and-ai\/","title":{"rendered":"Digital Regulations in China in 2026: Changes in Cybersecurity, Data Protection, and AI"},"content":{"rendered":"\n

In 2026, China is undergoing a true regulatory revolution in the digital sphere. From the amendment to the Cybersecurity Law (CSL) to the development of the Personal Information Protection Law (PIPL), and on to the first comprehensive AI ethics review system. The Chinese legal landscape is becoming increasingly complex and challenging for companies operating in this market. In this article, we analyze the most important changes, their practical implications, and the differences between the Chinese and European approaches to digital regulation. <\/strong><\/p>\n\n

1. Cybersecurity in China: The 2026 Amendment to the Cybersecurity Law<\/h2>\n\n

1.1. The biggest change since 2017<\/h3>\n\n

On January 1, 2026, the first amendment to China\u2019s Cybersecurity Law (\u7f51\u7edc\u5b89\u5168\u6cd5) took effect. This is the first major update to the law since it took effect in June 2017. The amendment, approved in October 2025 by the Standing Committee of the National People\u2019s Congress, introduces three key changes <\/strong>that directly affect all entities operating in China or with Chinese partners. <\/p>\n\n

1.2. Extended extraterritorial jurisdiction (Article 77 of the CSL)<\/h3>\n\n

Prior to the amendment, the CSL was limited to attacks on China\u2019s critical infrastructure (CII). Following the changes, the scope of the regulations was expanded to include all \u201cactivities by foreign entities that threaten the security of China\u2019s cyber networks.\u201d<\/strong> This means that even companies based outside China may be subject to sanctions\u2014including asset freezes\u2014if their activities are deemed a threat to Chinese cybersecurity. This change is particularly significant for international operators, including shipowners, whose onboard communications may fall under Chinese jurisdiction. <\/p>\n\n

1.3. Tiered Penalty System<\/h3>\n\n

The amendment to China\u2019s Cybersecurity Law puts an end to legal ambiguities by introducing a precise schedule of penalties. The new system directly links the severity of sanctions to the actual consequences of an incident. Importantly for businesses, financial liability increases sharply, and the consequences affect not only corporate budgets but also the personal finances of executives. <\/p>\n\n

Under the new legal framework, financial risk is categorised into three levels.<\/p>\n\n

A fundamental breach, i.e. a breach without the need to prove damage<\/strong><\/h4>\n\n

A basic breach of the regulations is punishable by a fine of between 50,000 and 500,000 RMB (Renminbi, which is equivalent to between approximately 6,000 EUR and over 64,000 EUR, and between approximately 27,000 PLN and over 270,000 PLN). Most importantly from the perspective of the regulatory authorities, this penalty may be imposed without the need to prove that the incident caused any actual losses. <\/p>\n\n

Aggravating circumstances<\/strong><\/h4>\n\n

The stakes rise significantly when incidents of a more serious nature occur. The new regulations define these situations precisely, citing, amongst other things, \u2018mass data breaches\u2019 or \u2018partial disruption of critical infrastructure\u2019. In such cases, a company faces a fine of between 500,000 and 2,000,000 RMB (which, when converted to euros, ranges from approximately 64,000 EUR to nearly 260,000 EUR, and when converted to Polish zlotys: from over 270,000 PLN to approximately 1.1 million PLN). However, that is not all \u2013 the amendment personalises liability by imposing a personal fine of between 50,000 and 200,000 RMB on the decision-maker. <\/p>\n\n

Worst-case scenario<\/strong><\/h4>\n\n

At the top of this pyramid of sanctions are cases classified as having \u2018particularly serious consequences\u2019. Here, the financial penalties range from 2,000,000 to as much as 10,000,000 RMB<\/strong> (i.e. from over 250,000 EUR to approx. 1.29 million EUR, or from approx. 1.1 million PLN to over 5.48 million PLN). At the same time, pressure on senior management is rising dramatically \u2013 a person responsible for gross negligence faces a personal fine of up to 1,000,000 RMB. <\/p>\n\n

1.4. Reductions in penalties<\/h3>\n\n

The amendment is not purely punitive. It also introduces mechanisms for the mitigation or remission of penalties, in accordance with the Administrative Penalties Act. The Cyberspace Administration of China (CAC) may reduce a penalty where the offender voluntarily eliminates or mitigates the harmful effects of the infringement, acted under duress or inducement, voluntarily discloses an infringement unknown to the regulators, and cooperates with law enforcement authorities. In the case of a first-time breach with minor consequences that has been rectified without delay, the penalty may even be waived entirely. <\/p>\n\n

1.5. New obligations for critical infrastructure operators (CIIs)<\/h3>\n\n

The amendment to the regulations places critical infrastructure operators, in particular, on high alert. These are the entities responsible for strategic sectors such as energy, transport, water management, finance and public services.<\/strong> For these pillars of the state\u2019s functioning, Beijing has drawn up a package of obligations that raise the bar for day-to-day operational activities. <\/p>\n\n

First and foremost, any purchase of online products or services by these entities must now be preceded by a more rigorous security assessment. At the same time, the state is tightening the system for monitoring users themselves by introducing a strict requirement for real-name authentication<\/em> for the most important online services, which in practice eliminates anonymity. <\/p>\n\n

However, the greatest emphasis has been placed on data transparency. Operators have been subject to significantly broader obligations than before to immediately report any security incidents to the regulatory authorities. Furthermore, the amendment enshrines the principle of data localisation: all information generated within China must physically remain in the country<\/strong>. Cross-border transfers are only permitted in exceptional circumstances \u2013 following a complex administrative procedure, culminating in official approval by the regulator. <\/p>\n\n

\"Digital\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n

2. Protection of personal data in China: the evolution of the PIPL<\/h2>\n\n

2.1. PIPL as the \u2018Chinese GDPR\u2019<\/h3>\n\n

The Personal Information Protection Law <\/strong>(PIPL, \u4e2a\u4eba\u4fe1\u606f\u4fdd\u62a4\u6cd5) came into force on 1 November 2021. It is the first comprehensive piece of legislation at national level governing the protection of personal data in China. Although it is often compared to the European GDPR, the PIPL has important differences that every company needs to be aware of. <\/p>\n\n

2.2. The main similarities and differences between the PIPL and the GDPR<\/h3>\n\n

The Chinese Personal Information Protection Law (PIPL) resembles the European GDPR in many respects, which makes it easier for entities operating in the international market to understand its principles. Both sets of regulations are based on a similar definition of personal data, understood as information relating to an identified or identifiable natural person<\/strong>. As in Europe, the standard requirement in China is to obtain consent for processing, and citizens are granted a similar set of rights: the right to access, rectify, erase and transfer their data. <\/p>\n\n

The supervisory mechanisms and sanctions are also similar. Organisations processing the data of more than one million people are required to appoint the equivalent of a Data Protection Officer (PIPO), and serious breaches are subject to heavy financial penalties \u2013 up to 50 million RMB or 5 per cent of annual turnover. <\/p>\n\n

Despite such striking similarities, there are several fundamental differences that set the Chinese system apart.<\/p>\n\n

Absence of a \u2018legitimate interest\u2019<\/strong><\/h4>\n\n

Unlike the GDPR, where this is one of the most important and most frequently used legal bases for data processing, the PIPL does not provide for such an arrangement. In the Chinese legal system, the user\u2019s informed consent remains the primary \u2013 and often the only \u2013 legal basis for data processing operations. <\/p>\n\n

The national security dimension<\/strong><\/h4>\n\n

Chinese legislation explicitly links data protection to the interests of the state. The PIPL contains mechanisms allowing for the creation of a so-called blacklist of foreign entities<\/strong>. Companies included on this list may, for security reasons, be completely barred from accessing the personal data of Chinese citizens. <\/p>\n\n

Data protection for deceased persons<\/strong><\/h4>\n\n

This is a significant departure from European standards, where data protection rights expire upon a person\u2019s death. In China, close relatives may exercise rights over a deceased person\u2019s data in pursuit of their own legitimate and lawful interests. <\/p>\n\n

Higher age limit for children<\/strong><\/h4>\n\n

PIPL takes a more restrictive approach to the protection of the youngest children. Parental consent to the processing of their children\u2019s data is required for all children under the age of 14 (by comparison, under the GDPR, the general age limit is 16, with the option for individual countries to lower this to 13). <\/p>\n\n

Specific restrictions for the public sector<\/strong><\/h4>\n\n

National public authorities are subject to a strict localisation rule. All personal data they collect must be stored exclusively within Chinese territory. <\/p>\n\n

2.3. The new GB\/T 45574-2025 standard \u2013 sensitive data<\/h3>\n\n

From 1 November 2025, the national standard GB\/T 45574-2025 will come into force in China, introducing significant changes to the way sensitive data is identified.<\/strong> Instead of the previous, rigid catalogue of information, the new regulations require companies to analyse the context of data processing on a case-by-case basis and assess the impact of these activities on the privacy and security of a specific individual. <\/p>\n\n

Under the new guidelines, the category of sensitive data primarily includes:<\/p>\n\n

    \n
  • biometric data, including facial recognition systems,<\/li>\n\n\n\n
  • information on financial accounts,<\/li>\n\n\n\n
  • precise location data,<\/li>\n\n\n\n
  • information about one\u2019s state of health,<\/li>\n\n\n\n
  • personal data of minors under the age of 14.<\/li>\n<\/ul>\n\n

    Processing this type of information entails additional formal obligations. Organisations must obtain separate, explicit consent from the user and also provide them with detailed information about the purpose of the processing and its impact on their rights. <\/p>\n\n

    In addition, before carrying out any processing of sensitive data, organisations are required to conduct a data protection impact assessment (PIPIA \u2013 Personal Information Protection Impact Assessment<\/em>). The documentation compiled in this way must be retained for at least three years in the event of an inspection. <\/p>\n\n

    2.4. Cross-border data transfers and the new framework for incident reporting<\/h3>\n\n

    The Chinese system governing the transfer of personal data abroad is based on three distinct legal frameworks. These have been tailored to the scale of a company\u2019s operations and the type of information processed. <\/p>\n\n

      \n
    • Security Assessment. <\/em><\/strong>This procedure applies to organisations operating on a large scale. It is mandatory in situations where a company processes the data of more than one million individuals or where the data being transferred is classified by the state as \u2018sensitive data\u2019. <\/li>\n\n\n\n
    • Standard Contract.<\/em> <\/strong>This solution is designed for smaller organisations. It enables data transfers based on a standard contract template that has been approved by the CAC regulator. <\/li>\n\n\n\n
    • Certification.<\/em><\/strong> This option has been in place since the start of 2026 and is designed to facilitate the operations of international corporate groups. It enables companies to obtain a formal certificate from an authorised body, which simplifies the procedures for the flow of information within corporate structures. <\/li>\n<\/ul>\n\n

      In parallel with the streamlining of transfer rules, the regulations governing the response to crisis situations (Measures for the Administration of the Reporting of Cybersecurity Incidents<\/em>) have been tightened. These regulations require companies to notify regulatory authorities of security breaches within a strictly defined, short timeframe. <\/p>\n\n

      For most organisations, the basic deadline for reporting an incident is 4 hours<\/strong>. For critical infrastructure operators (CIIs), the requirements are stricter \u2013 in their scenario, this timeframe is one hour. The regulations also explicitly define the severity of individual incidents: a data breach involving more than one million personal data records is automatically classified as a \u2018relatively major<\/em>\u2019 incident. <\/p>\n\n

      2.5. The 2026 Enforcement Campaign<\/h3>\n\n

      In April 2026, Chinese regulatory bodies \u2013 led by the CAC, the Ministry of Industry and Information Technology (MIIT) and the Ministry of Public Security (MPS) \u2013 launched a coordinated campaign aimed at enforcing personal data protection regulations. These measures quickly led to specific decisions at local level and significant legal rulings. <\/p>\n\n

      This round of inspections is divided into three main areas.<\/p>\n\n

        \n
      • Removing incompatible applications.<\/strong> In the country\u2019s major economic centres, such as Beijing, Shanghai, Zhejiang, Jiangsu, Chongqing and Sichuan, local authorities have begun actively removing mobile apps from the market that have breached users\u2019 privacy rights.<\/li>\n\n\n\n
      • Simplifications for smaller businesses.<\/strong> Alongside these restrictive measures, the regulator is working to ensure a balance in administrative obligations. The CAC has published draft new regulations that simplify procedures for small data controllers, making it easier for smaller companies to comply with legal requirements efficiently. <\/li>\n\n\n\n
      • The courts\u2019 unequivocal position.<\/strong> A ruling by the Beijing Internet Court has become a key indicator for the market. The court ruled that the transfer of personal data to third parties without obtaining the user\u2019s separate, explicit consent constitutes a direct breach of the PIPL. <\/li>\n<\/ul>\n\n

        This ruling finally confirms that the practice of sharing information within business partnerships or advertising networks without the consumer\u2019s knowledge will not be tolerated in China<\/strong>.<\/p>\n\n

        \"Regulations\n\t\t\t\n\t\t\t\t\n\t\t\t<\/svg>\n\t\t<\/button><\/figure>\n\n

        3. Artificial intelligence in China<\/h2>\n\n

        3.1. The absence of a single piece of legislation \u2013 the five pillars of regulation<\/h3>\n\n

        Whilst the European Union has opted to create a single, comprehensive piece of legislation (the AI Act), China has adopted a different strategy. Beijing is taking a vertical approach<\/strong>, which involves regulating specific applications and algorithms through a range of specialised legislative and administrative measures. This entire system is based on five fundamental pillars<\/strong>. <\/p>\n\n

        Pillar 1: Government policies and strategies<\/h4>\n\n

        The direction of development is set out in official government plans, which define the country\u2019s strategic objectives. The first policy document of this nature was the \u2018Plan for the Development of Next-Generation Artificial Intelligence\u2019 from 2017. This document is supplemented by official guidelines from the Council of State, aimed at strengthening ethical oversight in the fields of science and new technologies, such as the \u2018Opinions on Strengthening Ethical Governance in Science and Technology\u2019. <\/p>\n\n

        Pillar 2: General legal provisions<\/h4>\n\n

        Regulations specific to artificial intelligence do not operate in a vacuum \u2013 they are underpinned by three key pieces of legislation. The Personal Data Protection Act (PIPL) protects personal data used to train and operate algorithms, the Data Security Act (DSL) ensures the protection of the data sets themselves, and the Cybersecurity Act (CSL) safeguards the network infrastructure on which AI systems rely. <\/p>\n\n

        Pillar 3: Administrative and sector-specific regulations<\/h4>\n\n

        This is where you\u2019ll find tools targeting specific technologies and their developers. One example is the \u2018Interim Guidelines for the Management of Generative AI Services\u2019 (AIGC Measures), which regulate content generated by language models or image generators. Separate, detailed regulations apply to recommendation systems and so-called deep synthesis technologies<\/em> \u2013 including, amongst other things, tools for creating deepfake content. <\/p>\n\n

        Pillar 4: Local and regional regulations<\/h4>\n\n

        Chinese cities enjoy a high degree of autonomy in shaping local market regulations. Major technology hubs, such as Shanghai and Shenzhen, are implementing their own regulations. The aim is, on the one hand, to promote innovation and, on the other, to enable local authorities to exercise detailed control over higher-risk AI products. <\/p>\n\n

        Pillar 5: National and technical standards<\/h4>\n\n

        The final component of the system is a set of precise engineering guidelines. The China Electronics Standardisation Institute is systematically developing a series of standards for artificial intelligence systems. According to the agreed timetable, work on over 50 new national and industry standards is due to be finalised by the end of 2026, which will set out uniform technical requirements for the entire market. <\/p>\n\n

        3.2. The rules of the game for generative AI \u2013 the principles underlying the \u2018AIGC Measures\u2019<\/h3>\n\n

        The document entitled \u201cInterim Rules on the Management of Generative Artificial Intelligence Services\u201d, drawn up by the CAC in collaboration with six other government agencies, came into force on 15 August 2023. To this day, it remains the most important piece of legislation governing the operation of content-generating systems within China. These regulations precisely define the obligations of technology providers and set clear boundaries for the commercial use of algorithms. <\/p>\n\n

        The key requirements for developers of AIGC (Generative AI) services include:<\/p>\n\n

          \n
        • the legality of training data <\/strong>\u2013 system providers must ensure and demonstrate that the sources of information used to train the models are entirely lawful;<\/li>\n\n\n\n
        • protection of privacy during the training phase \u2013 if personal data is contained in the training datasets, its use requires prior consent from the data subjects;<\/li>\n\n\n\n
        • respect for users\u2019 rights <\/strong>\u2013 artificial intelligence systems must be designed in such a way as to enable, from the outset, the exercise of the rights set out in the PIPL Act \u2013 including the right to access, rectify or erase data;<\/li>\n\n\n\n
        • built-in safeguards<\/strong> \u2013 providers are required to implement technical measures that effectively prevent data leaks and protect users\u2019 privacy.<\/li>\n<\/ul>\n\n

          The list of prohibited activities has been formulated just as clearly. Chinese law in this area unequivocally prohibits: <\/p>\n\n