Cybersecurity Law of China (2017) · Yalla China
中华人民共和国网络安全法 / Cybersecurity Law of China (2017)
Enacted: 2016-11-07 ✅ Effective: 2017-06-01
📝 Overview
Establishes the principle of Chinese digital sovereignty and requires network operators to store Chinese user data within China and implement approved security measures.
This is general information only, not legal advice. For your specific case, consult a licensed lawyer.
📜 The law text / key provisions
The Cybersecurity Law (2017) requires: (1) operators of critical networks to store personal data and important business data within China; (2) cross-border data transfer subject to prior government security assessment; (3) network operators to cooperate with national security authorities in monitoring operations; (4) prohibition on publishing restricted information. Unauthorized VPNs violate this law. Foreign companies need to understand data storage requirements before entering the Chinese market.
💬 Practical reading
💬 This is a general reading/opinion for orientation — not the official legal text nor legal advice.
This law directly affects foreign companies' digital operations in China. Establish a cybersecurity compliance plan before launching any digital service in the Chinese market.
📎 Official source
National People's Congress Standing Committee
🕒 Updated: 16 March 2026