4 questions before you choose the route.
This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.
Are you a network operator?
Almost any company running systems in China.
OperatorIs the system CII?
CII identification is a separate, heavier track.
CIIWhat MLPS class is realistic?
Resolve the what mlps class is realistic question separately before choosing the route.
ClassIncident or PIPL overlap?
Breach notice may implicate CSL, PIPL and sector rules.
IncidentWorking rule: CSL applies to the construction, operation, maintenance and use of networks in the PRC. Network operators have security, incident, and (for CII) supply-chain and localisation-adjacent duties.
The signal ledger.
These facts move the question beyond a label and into a product, money-flow and control analysis.
Bring a compact evidence docket—not a pitch deck.
Give a compliance team or counsel the operating facts that reveal the perimeter.
Questions people ask before they build.
Short answers for orientation. The right result can change with the service model and current rules.
Do all companies need MLPS class 3?
No. Many commercial systems sit at class 2; class 3 is common for significant systems. Do not guess.
Is CSL the same as PIPL?
No. CSL is network security; PIPL is personal information.
Primary authorities
Reviewed sources support orientation, not a fact-specific assessment.




