PRC Data Security Law (Draft)

Main contents: If an organization or individual outside the People's Republic of China engages in data activities and jeopardizes the national security of, the public interest in, or the lawful rights and interests of citizens or organizations of, the People's Republic of China, its/his/her legal liability shall be pursued in accordance with the law (Article 2).

The state shall subject data that constitute controlled items relating to the performance of international obligations and the safeguarding of national security to export controls in accordance with the law (Article 23).

Where a country or region adopts discriminatory prohibitive, restrictive or other similar measures against the People's Republic of China in terms of investment or trade in data, data development and exploitation technologies, etc., the People's Republic of China may, depending on the actual circumstances, take corresponding measures against the country or region in question (Article 24).

If an organization or individual that engages in data activities fails to perform its,/his/her data security protection obligations specified in Article 25, 27, 28 or 29 of the Law or fails to take necessary security measures, it/he/she may additionally be imposed a fine of not less than Rmb10,000 and not more than Rmb100,000. If it/he/she refuses to rectify the matter or causes serious consequences, such as a large data leak, it/he/she shall be imposed a fine of not less than Rmb100,000 and not more than Rmb1 million (Article 42).