Cyberspace Administration of China, Decision on Amending the «PRC Cybersecurity Law» (Draft for Comments)

Issued: September 12, 2022

Main contents: The Decision revises the legal liability systems for the violation of general provisions on the security of network operations, the security protection of critical information infrastructure and network information security. The proposed revisions are also aimed to align with the penalties of the PRC Law on the Protection of Personal Information.

If an operator of critical information infrastructure violates Article 35 hereof by using a network product or service that has not undergone or failed a security review, the relevant competent department shall order it to cease using the same and impose a fine of not less than the equivalent of and not more than 10 times the procurement amount thereof, or a fine of up to 5% of the business turnover of the previous fiscal year; and it shall fine the manager directly responsible and the other directly responsible persons not less than Rmb10,000 and not more than Rmb100,000 (Article 65).