General Office of the Ministry of Industry and Information Technology, Circular on Strengthening the Protection of the Security of Customer Data by Internet Data Centers

Issued: January 13, 2025


Main contents: An internet data center (IDC) shall expressly specif the responsibilities and obligations of each party for protecting the security of data in the contracts and agreements executed with customers, third-party service providers, etc. in light of the mode and substance of the cooperation (Article 2).

An IDC shall establish a customer management mechanism to offer customers, depending on the category of customer and their protection requirements, differentiated security protection measures for them to choose from (Article 4).

Where the offering of functions to manage datasets for artificial intelligence training is involved, an IDC shall offer the capability to safeguard the security of the customer’s own training datasets and avoiding the leakage and contamination of relevant datasets. Where the offering of computing power scheduling and computing power services is involved, it shall duly manage the security of computing power scheduling strategies and having monitoring and early warning of unusual use of computing power and emergency response capabilities so as to ensure the security of computing power scheduling (Article 12).

An IDC business operator may regularly conduct assessments of its capacity to protect the security of customer data itself or engage a third-party professional firm to do so (Article 14).