China Data Security Law (DSL): AI Compliance Requirements
China's Data Security Law (DSL, effective September 1, 2021) establishes a data classification and tiered protection system based on data's importance to national security and economic development. DSL applies to all data processing activities within China and extraterritorially when data processing outside China "harms China's national security, public interests, or the lawful rights and interests of Chinese citizens and organizations." For AI systems, DSL requires: data classification (including AI training data), security obligations proportionate to data category, and restrictions on cross-border transfer of "important data."
Summary of publicly-available regulatory text as of 2026-08-22. Verify against current official sources before relying on this for compliance decisions. Not legal advice.
Key Facts
September 1, 2021
¥2,000,000–¥10,000,000 (general violations); ¥5,000,000–¥50,000,000 (important data violations); service suspension; individual liability
What Your Business Must Do
4 compliance requirements identified. Critical requirements carry the highest risk of enforcement action.
AI Data Classification and Tiered Protection
CriticalClassify all data used in AI systems (training data, inference data, output data) according to DSL tiers: Core State Data, Important Data, or General Data. Implement security measures appropriate to each tier. Important Data requires enhanced security controls, access logging, and security assessments.
Deadline: September 1, 2021
DSL Art. 21Security Assessment for Important Data Export
CriticalIf your AI system processes "Important Data" (industry-specific: financial, healthcare, telecommunications, transportation, energy, public utilities), you must conduct a CAC security assessment before transferring this data outside China for AI processing. Cross-border AI inference on Important Data requires government approval.
Deadline: September 1, 2021
DSL Art. 31Prohibition on Unauthorized Foreign Government Data Provision
CriticalOrganizations in China must not provide data stored in China to foreign judicial or law enforcement agencies without approval from Chinese competent authorities. AI companies must establish a process for responding to foreign government data requests through approved Chinese government channels. Direct compliance with US/EU government data requests for China-stored data is prohibited.
Deadline: September 1, 2021
DSL Art. 36Data Security Management System
High PriorityEstablish a data security management system including: designated data security officer, data security education and training for staff, regular data security risk assessments, and data security incident response plan. Applies to all organizations processing data in China.
Deadline: September 1, 2021
DSL Art. 27Who Does This Apply To?
DSL applies to: (1) data processing activities within China; (2) data processing activities outside China that harm China's national security, public interests, or Chinese citizens'/organizations' rights. "Data" means any record of information in any electronic or other form. Three-tier data classification: (1) Core State Data — data related to national sovereignty, security, national defense, foreign policy; (2) Important Data — data with significant impact on national security, economic operation, public interests; (3) General Data — all other data. AI training datasets must be classified and protected accordingly.
Recent Enforcement Actions
Against: DiDi Global Inc.
DiDi fined ¥8B under combined PIPL, DSL, and Cybersecurity Law. DSL-specific findings: DiDi collected geospatial data, infrastructure-related location data, and data about Chinese government facilities via its ride-hailing AI — classified as Important Data — without adequate security measures or cross-border transfer controls. Established that AI mobility data (real-time location, route patterns, infrastructure proximity) may qualify as Important Data.
SourceRecent Regulatory Guidance
MIIT — Important Data Identification Guidelines in the Industrial Field (effective 2025-04-01)
The Ministry of Industry and Information Technology (MIIT) released Important Data Identification Guidelines for the industrial sector on 2024-12-25, effective 2025-04-01, following a national standard on data classification/grading that took effect November 2024. Separately, PBOC and the National Financial Regulatory Administration (NFRA) published financial-sector data classification rules using a four-tier system (core data, important data, sensitive general data, ordinary general data). Key AI implication: industrial and financial AI training/inference datasets must be classified against the applicable sector catalog to determine whether Important Data cross-border-transfer controls (DSL Art. 31) apply.
SourceKey Case Law & Precedent
CAC cybersecurity review of Full Truck Alliance (Manbang) (2021)
Cyberspace Administration of China — cybersecurity review (administrative) · 2021On 5 July 2021 the CAC opened a cybersecurity review of Full Truck Alliance (the "Uber for trucks" platform, NYSE: YMM) — together with Kanzhun/Boss Zhipin and days after the DiDi action — citing national data-security risk over its logistics/supply-chain data, treated as potential Important Data under the DSL. Illustrates that AI platforms with significant transportation/logistics data may hold data classified as Important Data regardless of explicit sensitivity marking; infrastructure-adjacent AI companies should run proactive Important Data classification. R134 CORRECTION: the review opened just AFTER (not before) the June 2021 US IPO.
Outcome: CAC suspended new-user registration during the review (announced 5 July 2021). (The June 2021 NYSE IPO had already completed; the review followed it.)
Case referenceQuarterly Enforcement Digest
DSL enforcement integrated with PIPL and Cybersecurity Law. A national data classification/grading standard took effect November 2024, followed by sector-specific Important Data catalogs — MIIT's industrial-sector guidelines (released 2024-12-25, effective 2025-04-01) and PBOC/NFRA's four-tier financial-data classification scheme are the clearest documented examples; AI companies in industrial and financial sectors should complete Important Data classification against their sector's catalog. Cross-border AI processing of Important Data via overseas APIs requires CAC security assessment approval — driving adoption of China-domestic AI models. Key practical impact: foreign AI SaaS companies offering services to Chinese enterprises must deploy on China-based servers (Alibaba Cloud, Tencent Cloud, Huawei Cloud) and cannot route Chinese data classified as Important Data through overseas AI APIs without an approved security assessment.
Digest covers enforcement actions, guidance, and regulatory developments. Last verified: 2026-08-22.
Industry Playbooks covering China Data Security Law (DSL)
These industry playbooks include jurisdiction-specific checklist items and guidance for China Data Security Law (DSL).
Frequently Asked Questions
Does China Data Security Law (DSL) apply to my business?
China's Data Security Law (DSL, effective September 1, 2021) establishes a data classification and tiered protection system based on data's importance to national security and economic development. DSL applies to all data processing activities… Use Aegis Firma's free scanner to get a personalized assessment in under 5 minutes.
What is the penalty for non-compliance?
The maximum penalty under China Data Security Law (DSL) is: ¥2,000,000–¥10,000,000 (general violations); ¥5,000,000–¥50,000,000 (important data violations); service suspension; individual liability. Fines are typically scaled by company size, severity of violation, and whether violations were willful or accidental.
How do I comply with China Data Security Law (DSL)?
The 4 requirements above cover the core obligations. The fastest path to compliance is: (1) conduct an AI risk assessment, (2) document your AI systems, (3) implement transparency disclosures where required. Aegis Firma generates all required documents automatically.
Official Source
https://www.chinalawtranslate.com/en/data-security-law/Last updated: 2026-08-22 — verify at source before relying on this information.
Don't leave compliance to chance
Aegis Firma scans your AI tools, tells you exactly which regulations apply, and generates all required documents — in 30 minutes.
Start your free compliance scan