On 2 April 2024 the National Data Administration published draft guidance on deepening smart-city development and advancing city-wide digital transformation, open for comment until 8 April. A one-week window suggests the framework is already mature internally and that comments are meant to calibrate wording and fill gaps.
What “city-wide” changes
Earlier smart-city projects were organised by department or single scenario: one platform for transport, one for healthcare, one entry point for government services. City-wide transformation treats the city as a whole and requires data to move between departments and platforms to interconnect. The consequence for suppliers is direct: a vendor that covers only one vertical is increasingly unlikely to win a project alone. The customer also changes: procurement may shift from a single department to a city-level platform company, and acceptance criteria move from feature delivery to cross-department coordination. Relationships built around one scenario no longer carry a project on their own.
A city data security system
The draft places a city data security system at three levels. Classification and grading come first: a city platform aggregates mixed data, with public data, personal information and important data sharing the same pipeline. Security operations come next, requiring continuous monitoring and incident response rather than a one-off assessment. Personal information protection is the floor: city platforms hold records on large numbers of residents, and collection scope and purpose need boundaries.
Authorised operation of public data
City-wide digitalisation depends on public data supply. Authorisation has to answer three questions: to whom, for what, and on what revenue terms. Operators generally need security capability and professional qualifications, and the authorisation agreement should set purpose limits, prohibit re-authorisation and address data disposal on exit.
For AI companies, public data is an important source of corpora and scenarios, but authorisations usually carry purpose and re-provision limits. Designing products around the authorised scope is cheaper than adjusting after the data arrives.
City platforms and public-private cooperation
City-level platforms are often led by a local platform company with technology firms participating as partners. Contracts then have to handle data return, system integration, IP ownership and maintenance responsibility. The recurring dispute is whether the technology firm may continue to use data and models created during the project after acceptance.
Reading a short comment window
A short window signals that the framework is fixed and that industry can influence implementation detail. Useful comments should point to specific provisions, describe the practical obstacle and propose an alternative, rather than express general support or opposition.
For public data and personal information compliance, see our data compliance service; for security operations and incident response on city platforms, see cybersecurity compliance. Definitions are in the glossary.
This article is based on the draft guidance on deepening smart-city development and advancing city-wide digital transformation, published by the National Data Administration on 2 April 2024, and on public information. It is for reference only and does not constitute legal advice.