Cyber-security legislation banning the collection and sale of users’ personal information will come into force across China on Thursday.

Chinese officials have insisted that the law will not restrict foreign companies from operating in the country.

All companies operating in China will have to store user data on servers inside the country to comply with the new legislation.

That means that any information relating to Chinese citizens or China’s national security must be held on Chinese servers.

Companies will have to submit to a review by regulators before transferring large amounts of personal data abroad.

Any company holding data that, if breached, could “harm people’s livelihoods” must go through a more thorough “national security review” to ensure they and their data systems are “secure and controllable”.

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData
Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

The terminology is so vague that even fast-food companies could hold data with the potential to harm people’s livelihoods, because they provide a service to millions of people.

Foreign companies under threat?

Despite assurances from Chinese officials, business representatives and analysts have warned that the legislation will give Chinese companies an unfair advantage over foreign ones.

“The law is both extremely vague and exceptionally wide in scope, potentially putting companies at risk of regulatory enforcement that is not related to cyber security,” Carly Ramsey, associate director at Control Risks, a risk-management consultancy told the Financial Times.

In a letter to the Cyberspace Administration of China (CAC) seen by Reuters, a group representing European business interests said that the legislation would lead to “great uncertainties and compliance risks”.

The European Union Chamber of Commerce in China told the CAC that the law was “fraught with weaknesses” and called for its introduction to be delayed to “allow sufficient discussion”.

Foreign companies will have to undergo a huge amount of restructuring in order to comply with the new laws, Xun Yang, a lawyer at Simmons & Simmons in Shanghai, told the Financial Times.

He said:

The message is clear that the government will encourage more domestic development of technology, and that it now sees privacy and cyber security as vital national concerns.

However, Scott Schober, a cyber security expert and author of Hacked Again told Verdict that the new legislation is still very vague.

“New cyber security laws taking effect in China remain unclear, leaving foreign companies that operate in that territory unsure of where they stand,” he explained.

He added that greater transparency is crucial.

“These new cybersecurity laws mandate that companies must store their data within China.  Certain communications and finance business sectors would be scrutinized even further with additional security checks to be imposed. Anytime there is ambiguity in a law, it leaves wiggle room for interpretation which costs organizations in time and money due to inaction. The last thing that China needs are corporations sitting on the fence so hopefully they will provide further transparency for their new cyber laws,”

China dismisses criticism

However, the CAC insists that the cyber security law will go ahead as planned, despite the concerns voiced by members of the global business community.

“The purpose is to safeguard [China’s] national cyber-space sovereignty and national security… rather than to restrict foreign enterprises,” the CAC said in a statement on its website.

“It does not restrict foreign companies or their technology and products entering the Chinese market, neither does it limit the orderly, free flow of data in accordance with the law,” it added.