China's network data security regulation takes effect: the compliance baseline for network data handling

On 1 January 2025 the Regulations on the Administration of Network Data Security (State Council Order No. 790) took effect. The administrative regulation consolidates network data security requirements previously spread across statutes and departmental rules into a systematic set of rules, giving network data processing a clearer compliance baseline.

Three problems the regulation addresses

First, who is covered. The regulation defines the scope of network data processors and their duties, so that “who must comply” no longer depends on case-by-case judgement.

Second, classification and important data. It imposes stricter requirements on the handling of important data, including risk assessment and security protection measures, which link to the risk assessment rules issued later. See our notes on the draft network data security risk assessment and on the network data security risk assessment measures.

Third, cross-border transfer and platform responsibility. The regulation sets rules on providing data abroad and on the duties of large network platforms, bringing cross-border transfer requirements into a unified administrative regulation.

Direct meaning for AI companies

AI companies inherently process large volumes of network data: training data, user interaction data, logs and model inputs and outputs. Once the regulation took effect, the compliance requirements for these activities moved from “applied by reference” to “directly applicable”.

Companies need to review in particular whether data classification is established, whether important data is identified and protected, and whether cross-border transfers have completed the relevant procedures. See our notes on the data property rights registration guide and on China’s data export policy Q&A.

A baseline, not the endpoint

The regulation is foundational; specific duties still require the supporting measures and sector rules. Treating the regulation as the ground layer and then adding personal information protection, cross-border transfer and sector-specific requirements is a clear order of construction. See our notes on the obligations of major personal information processors.

In timing, its entry into force in early 2025 also marks network data governance moving from a period of rule-making into a period of execution.

This article is based on the Regulations on the Administration of Network Data Security (State Council Order No. 790) and public information and is for reference only; it does not constitute legal advice.