Data Strategy Briefing — June 10, 2021

Executive briefing: The Standing Committee of the National People's Congress adopted the Data Security Law (DSL) on 10 June 2021, with enforcement beginning 1 September 2021. The DSL introduces national core data categories, security assessments for cross-border transfers, and localisation mandates for critical information infrastructure operators handling critical data.

Key localisation checkpoints

• Data inventories. Classify datasets linked to China operations against DSL definitions for important and core data, capturing business ownership, storage locations, and processing purposes.
• Cross-border assessments. Design review workflows to evaluate security, necessity, and legal basis before transmitting important data outside China, anticipating CAC security assessments.
• Critical infrastructure scope. Determine whether Chinese subsidiaries qualify as critical information infrastructure operators and, if so, apply localisation and onshore backup requirements.

Operational priorities

• Governance updates. Align internal data governance charters and incident response playbooks with DSL penalty structures and enforcement mechanisms.
• Vendor management. Amend contracts with Chinese service providers to reflect DSL compliance clauses, inspection support, and security certification expectations.
• Regulatory engagement. Establish channels with provincial regulators to monitor forthcoming implementing rules on sector-specific data catalogues.

Enablement moves

• Integrate DSL requirements into enterprise risk registers alongside PIPL and Cybersecurity Law controls.
• Stage tabletop exercises covering cross-border transfer approvals and breach notifications under the DSL regime.

Sources

• Order of the President of the PRC No. 84 — Data Security Law
• China Law Translate: Data Security Law (unofficial translation)

Zeph Tech supports DSL readiness through China data mapping, localisation roadmaps, and cross-border transfer governance aligned to CAC expectations.

Related briefings

Curated signals from the same pillar or overlapping topics.

Data Strategy · Credibility 40/100 · September 24, 2021

Data Strategy Briefing — September 24, 2021

Saudi Arabia’s Personal Data Protection Law, issued 24 September 2021, introduces SDAIA-led consent, localisation, rights, and breach notification duties with a one-year grace period before penalties apply.

Data Strategy · Credibility 40/100 · November 30, 2021

Data Strategy Briefing — November 30, 2021

Expanded briefing on the provisional Data Governance Act agreement with governance, neutrality, and board oversight steps anchored in primary EU sources.

Data Strategy · Credibility 40/100 · October 21, 2020

Data Strategy Briefing — China releases draft Personal Information Protection Law

China’s National People’s Congress published the draft Personal Information Protection Law (PIPL) on 21 October 2020, proposing GDPR-style consent rules, cross-border transfer approvals, and steep penalties that would…

Data Strategy · Credibility 40/100 · September 1, 2022

Data Strategy Briefing — China Cross-Border Data Security Assessments Effective

China's Cyberspace Administration began enforcing mandatory security assessments for certain cross-border data transfers on 1 September 2022, requiring exporters to file assessments or adopt standard contracts before…

Data Strategy · Credibility 40/100 · March 17, 2020

Data Strategy Briefing — March 17, 2020

The Reserve Bank of India's payment aggregator framework requires Indian incorporation, escrow safeguards, domestic storage of payments data, and intensive merchant oversight, pushing fintechs and global merchants to…

Continue in the Data Strategy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Data Interoperability Engineering Guide — Zeph Tech

  Engineer interoperable data exchanges that satisfy the EU Data Act, Data Governance Act, European Interoperability Framework, and ISO/IEC 19941 portability requirements.

• Data Stewardship Operating Model Guide — Zeph Tech

  Establish accountable data stewardship programmes that meet U.S. Evidence Act mandates, Canada’s Directive on Service and Digital, and OECD data governance principles while…

• Data Strategy Operating Model Guide — Zeph Tech

  Design a data strategy operating model that satisfies the EU Data Act, EU Data Governance Act, U.S. Evidence Act, and Singapore Digital Government policies with measurable…