China will implement a string of new cybersecurity rules next year, authorities announced on September 30, placing an emphasis on national security and requiring companies providing generative artificial intelligence services to add extra data protection.
The network data security management regulations contain 64 clauses based on China’s cybersecurity and data security laws. They will go into force on January 1.
China has been working on the document since the initial draft was released nearly three years ago.
Under the new rules, companies that provide services related to generative AI must enhance their training in data processing and other areas. They are also required to take steps to prepare for data breach risks. Non-Chinese operators must establish data processing centers within China if they handle personal data originating from the country.
Under the general provisions, data processors that are deemed to have undermined China’s national security, the public interest or legally protected interests will be held legally responsible. This applies regardless of whether the data is processed within China or abroad.
The regulations call on businesses to follow guidance from the ruling party and take a broad view of national security that covers the economy, science and technology, in addition to national defense.
Companies and others involved in data processing are required to comply with national standards and report to authorities within 24 hours in the event of a data breach or other issues that could compromise national security. The rules also authorize national security officials to launch investigations.
Under the new rules, the state will encourage platforms to require personalized internet identification from users before allowing them to access online services. A proposal for establishing such cyberspace IDs was drafted by the government in July.
The proposal raised concerns that it could lead to tighter control over internet use. The mention of cyberspace IDs in the new regulations suggests that the government is intent on promoting the measure.
From 2017 to 2021, the Chinese government drew up three laws governing the internet. It is tightening rules concerning the overseas transfer of data.