China Data Security Law

DSL is data classification and national-security-grade data — not a second PIPL.

The Data Security Law applies to data handling in the PRC and, in defined cases, to overseas handling that harms PRC national security or public interest. It requires classification, protection by class, risk assessments for important data, and a gated story for export of important data. It is not PIPL (personal information) and not CSL (network security), though the three stack. Do not reprint sector catalogues here; they move.

The classification screen

4 questions before you choose the route.

This page identifies the right question and evidence. It does not determine the legal outcome on a reader’s facts.

Is the dataset PI, important data, or both?

PIPL and DSL can both apply.

Class

Is there a catalogue or CII overlay?

Sector and local identification.

Catalogue

Is export on the table?

Important-data export is usually assessment-grade.

Export

Who is the regulator set?

CAC plus sector, not only a privacy officer.

Regulator

Working rule: The Data Security Law applies to data handling in the PRC and, in defined cases, to overseas handling that harms PRC national security or public interest.

What changes the answer

The signal ledger.

These facts move the question beyond a label and into a product, money-flow and control analysis.

Signal

Ask the operating question

Why it changes the route

PIPL rename

Did counsel title a PIPL memo ‘DSL compliance’?

Different statute, different duties.

No catalogue, no duty

Are you waiting for one national PDF?

Identification is often sectoral.

Trade secret = important data

Did you label source code as DSL important data by vibe?

Wrong category.

Prepare before you escalate

Bring a compact evidence docket—not a pitch deck.

Give a compliance team or counsel the operating facts that reveal the perimeter.

01Data mapTypes, systems, sector, storage.

02Catalogue checkDated sector/local important-data rules.

03CII statusWhether the operator is identified.

Common confusions

Questions people ask before they build.

Short answers for orientation. The right result can change with the service model and current rules.

Does DSL apply to ordinary customer names?

Those are primarily PIPL. They become a DSL story if they are also identified as important data or sit in a CII system.

When is a more detailed analysis needed?

No. The national guide stays on its URL. This is the DSL definition layer.

Primary authorities

Reviewed sources support orientation, not a fact-specific assessment.

PIPL / DSL / CSL (NPC laws database)

Cyberspace Administration of China

Gov.cn policy releases

National laws database (NPC)