How to Comply with CAC Financial Data Classification China 2026: Step‑by‑step Implementation Guide for Banks & Financial Institutions

On 24 January 2026, the Cyberspace Administration of China (CAC) released the Guidelines for Data Classification and Grading of Financial Information Service Data (金融信息服务数据分类分级指引), establishing the first unified framework that tells banks, payment institutions and fintechs exactly how to inventory, classify and grade the financial data they hold in China. Understanding how to comply with CAC financial data classification China 2026 is now the single most urgent compliance priority for any institution that processes financial information within the PRC.

The Guidelines introduce a mandatory four‑tier grading system, core data (核心数据), important data (重要数据), sensitive general data and general data, and require institutions to build auditable inventories, conduct data protection impact assessments (DPIAs), remediate vendor contracts and, where applicable, submit important‑data catalogues to regulators. This guide walks compliance officers, in‑house counsel and external advisers through the end‑to‑end implementation steps, ownership matrix, document checklist, realistic timeline and cost budget they need to reach compliance before regulator review or internal audit.

Overview of the CAC Financial Data Classification Process and Who It Applies To

The Guidelines for Data Classification and Grading of Financial Information Service Data sit within the broader regulatory architecture created by the Data Security Law (DSL), the Personal Information Protection Law (PIPL) and sector‑specific PBOC and CBIRC guidance. The CAC Guidelines financial data framework operationalises the DSL’s requirement for every industry sector to produce classification and grading rules tailored to its own risk profile.

Financial information service data, covering transaction records, account details, credit assessments, payment flows, market data feeds and customer due‑diligence files, is now subject to a structured six‑step process: inventory data resources, classify data by subject‑matter domain, grade data against national‑security and public‑interest impact criteria, compile a classification and grading list, apply differentiated controls and maintain classifications through dynamic updates.

The data classification requirements China 2026 apply to any entity that collects, stores, processes, transmits or provides financial information service data within the territory of the PRC. This includes domestic commercial banks, policy banks, rural credit cooperatives, securities firms, insurance companies, payment institutions, licensed fintechs and financial information service providers (FISPs) regulated under the Provisions on the Administration of Financial Information Services. Critically, third‑party processors and cloud vendors handling regulated financial data on behalf of in‑scope institutions are also caught, meaning the compliance obligation cascades through vendor and outsourcing chains.

Industry observers expect the likely practical effect to be a material increase in compliance documentation and internal governance, comparable in scale to the initial PIPL rollout. Every institution must produce, at minimum, a data inventory, classification register, DPIA, controls evidence pack, remediated vendor contracts and (where the institution holds important or core data) a regulator‑ready catalogue of important data. The sections that follow break each of these deliverables into concrete implementation steps.

Eligibility and Prerequisites for CAC Financial Data Classification

Before launching the classification project, institutions must confirm scope and satisfy a short list of governance prerequisites.

Entities in Scope

The Guidelines apply to all financial institutions and financial information service providers operating in China. Specifically:

• Domestic banks and NBFIs. All commercial banks, policy banks, rural and urban credit cooperatives, trust companies, finance companies, consumer finance companies and asset management companies supervised by the PBOC or the National Financial Regulatory Administration (NFRA).
• Securities and insurance entities. Securities companies, fund management companies, futures companies and insurance institutions supervised by the CSRC or NFRA.
• Payment institutions and licensed fintechs. Non‑bank payment institutions, lending platforms and other fintech licensees operating under PBOC or NFRA licences.
• Financial information service providers. Entities providing financial data, analytics, rating, credit‑scoring or market‑data services to financial institutions or the public.
• Foreign banks and branches. Foreign‑invested banks with PRC‑incorporated subsidiaries or branches, and any offshore entity whose systems process China‑resident financial data. Cross‑border data flows that touch PRC‑domiciled datasets bring the offshore processor within the Guidelines’ practical reach, requiring contractual safeguards and, in some cases, separate CAC or PBOC notifications.
• Third‑party processors and cloud vendors. Any technology vendor, outsourced service provider or cloud infrastructure provider that processes financial data on behalf of an in‑scope institution.

Governance Prerequisites

Before commencing the classification exercise, institutions should ensure the following prerequisites are in place:

• Board or senior‑management approval. A documented mandate authorising the project, budget and dedicated resources.
• Appointed Data Classification Lead. A named individual (typically the Head of Compliance, Chief Data Officer or CISO) with authority to convene the cross‑functional classification committee.
• Existing data governance policy. A board‑approved data governance framework aligned with the DSL and PIPL. Where no policy exists, drafting one is an immediate prerequisite.
• Legal review. External or in‑house legal counsel should review the institution’s current data‑processing agreements, cross‑border transfer mechanisms and DPIA inventory to identify gaps before the project begins.

Step‑by‑Step Procedure: How to Comply with CAC Financial Data Classification in 2026

The following six implementation steps form the compliance checklist that every in‑scope institution must work through. The table below provides a quick‑reference summary of each step, the responsible owner and a realistic duration estimate; detailed guidance follows in the numbered sub‑sections.

Step 1, Establish Governance and a Project Plan

Owner: Head of Compliance / CTO. Objective: Secure executive sponsorship, define project scope, assemble the classification committee and allocate budget.

Obtain formal board or senior‑management sign‑off through a documented approval memo. Appoint the Data Classification Lead and convene a cross‑functional committee comprising representatives from Legal, Risk, IT/Data Engineering, Information Security and Vendor Management. Prepare a project charter that sets out milestones, resource requirements, communication cadence and an initial risk register. Shortlist any legal‑tech or data‑discovery vendors whose tooling will be needed for Step 2. Budget estimates should cover internal labour, tooling licences, external advisory and remediation costs (see the Costs section below).

Deliverables to retain: signed project charter, stakeholder map, board approval memo, initial risk register and budget estimate.

Red flag: Proceeding without documented senior‑management approval is a common audit finding. Regulators look for evidence of governance before examining technical controls.

Step 2, Conduct a Full Data Inventory and Data‑Flow Mapping

Owner: Data Engineering / IT, supported by Compliance. Objective: Produce a comprehensive, system‑by‑system inventory of every financial dataset stored or processed in China, and map all inbound and outbound data flows.

Deploy automated data‑discovery tools or conduct manual system surveys to catalogue every database, data warehouse, data lake, file share, SaaS application and API endpoint that holds financial information service data. For each dataset, record the system owner, data subjects (customers, counterparties, employees), data types (account data, transaction data, credit data, market data), storage location (on‑premise or cloud, region), retention period and whether the data is transferred cross‑border.

Map data flows using standardised diagrams showing the origin, intermediate processors, destinations and transfer mechanisms for each dataset. Where data crosses national borders, note the legal basis for the transfer (standard contract, CAC security assessment or PIPL certification). Prepare a draft DPIA scope document listing every dataset that will require a formal data protection impact assessment in Step 4.

Deliverables to retain: data‑inventory export (CSV or database extract), data‑flow diagrams, draft DPIA scoping document and a reconciliation log confirming coverage against the institution’s system register.

Quick win: Start with systems already catalogued in the institution’s PIPL or DSL records, then expand to identify shadow IT and ungoverned data stores. Conduct spot checks by sampling live system access logs against the inventory to detect omissions.

Step 3, Perform the Classification and Grading Exercise

Owner: Data Classification Committee (Legal + Risk + IT). Objective: Assign each dataset to a classification domain and then grade it within the four‑tier hierarchy mandated by the CAC Guidelines.

The classification step groups datasets by subject‑matter domain, for example, customer identity data, transaction and payment data, credit and risk data, market and pricing data, internal operations data. Once classified, each dataset must be graded against the impact criteria specified in the Guidelines. The four grading tiers are:

• Core data (核心数据). Data whose compromise could seriously endanger national security, the macro‑economy or major public interests, typically systemic financial infrastructure data, cross‑market aggregate datasets or data designated as core by regulators.
• Important data (重要数据). Data whose tampering, destruction, leakage or illegal use could endanger national security, economic operation, social stability or public health and safety. This includes large‑scale customer financial data, significant transaction datasets and strategically sensitive information.
• Sensitive general data. Data that could cause limited harm to individuals, organisations or public interests if compromised, for example, individual account balances, personal credit records or internal risk models.
• General data. Data with negligible impact if compromised, publicly available market data, anonymised statistical outputs or published regulatory filings.

For each dataset graded as important or core, the committee must prepare a written grading rationale memo documenting the criteria applied, the scoring methodology and the decision. Borderline datasets should be escalated to senior management for adjudication. Update source systems and data catalogues with classification and grading labels.

Deliverables to retain: classification register (Excel or GRC‑system record), grading rationale memos for every important or core dataset, committee meeting minutes and a summary report for senior management.

Step 4, Map Controls and Complete the DPIA

Owner: CISO / IT Security, supported by Legal. Objective: Derive the technical and organisational controls required for each grading tier, complete formal DPIAs for graded datasets and validate that controls are implemented and tested.

Using the grading output from Step 3, map each dataset to its required control baseline. Higher‑grade data (core and important) will require stricter access controls, encryption at rest and in transit, data segregation, enhanced logging, shortened retention periods and more frequent audit cycles. Sensitive general data requires standard security controls aligned with PIPL and DSL baselines, while general data requires only basic hygiene measures.

Complete a formal DPIA for every dataset classified as important or core, and for any dataset involved in cross‑border transfers. The DPIA should assess the necessity and proportionality of the processing, evaluate risks to data subjects and the state, describe existing and planned mitigations and conclude with a risk‑acceptance recommendation signed off by the Head of Compliance or a delegated senior officer.

Run control‑effectiveness testing, including penetration tests, access‑control audits and encryption‑key management reviews, and document the results. Log any control gaps in a remediation backlog with owners and deadlines.

Deliverables to retain: DPIA report (signed), control‑mapping matrix, penetration‑test and audit reports, remediation backlog with status tracking and evidence of management sign‑off on residual risk.

Step 5, Remediate Contracts and Third‑Party Arrangements

Owner: Legal / Vendor Management. Objective: Review and update all vendor, outsourcing and inter‑company agreements to reflect classification‑grade‑specific security obligations, cross‑border transfer safeguards and audit rights.

Identify every third party that processes, stores or has access to data graded as sensitive, important or core. For each relationship, review the existing contract and assess whether it includes:

• Security obligations. Explicit requirements for the processor to apply controls at least equivalent to the institution’s own control baseline for the relevant grading tier.
• Cross‑border transfer clauses. Where data is transferred outside the PRC, the contract must specify the legal basis (CAC‑filed standard contract, security assessment or PIPL certification), require the recipient to maintain equivalent protections and impose re‑transfer restrictions.
• Audit rights. The institution must retain the right to audit the processor’s compliance with classification and security obligations, including on‑site inspections and access to logs.
• Breach notification timelines. The processor must notify the institution of any security incident within a specified period (industry practice is 24–72 hours) to enable timely regulator notification under DSL and PIPL requirements.

Where contracts lack these provisions, issue amendments or addenda. For high‑risk vendors handling important or core data, conduct a vendor security assessment or on‑site audit before granting continued access.

Deliverables to retain: contract amendment schedule, executed amendments and addenda, vendor audit reports and a clause‑bank reference document for future negotiations.

Step 6, Submit the Important‑Data Catalogue and Establish Ongoing Governance

Owner: Head of Compliance / Regulatory Affairs. Objective: File the important‑data catalogue with the relevant regulator (if required), formalise periodic review procedures and embed classification governance into business‑as‑usual operations.

Compile the important‑data catalogue in the format expected by the CAC and any sector regulators (PBOC, NFRA, CSRC). The catalogue should list each important and core dataset, its grading rationale, the responsible business unit, the storage location, the control baseline applied and any cross‑border transfers. Submit the catalogue to the relevant data‑regulatory authority within the timeframe specified in the Guidelines or follow‑on sector rules. Retain proof of submission.

Establish an internal governance cycle that includes quarterly reviews of the classification register, triggering a reclassification whenever new data types are introduced, systems change or regulatory guidance is updated. Conduct a full annual reclassification exercise. Integrate classification governance into the institution’s existing data‑governance, information‑security and internal‑audit frameworks to avoid creating a siloed compliance function.

Deliverables to retain: important‑data catalogue (regulator and internal versions), proof of submission or filing receipt, periodic review schedule, standard operating procedures for dynamic updates and internal audit reports confirming ongoing effectiveness.

Required Documents and Information for CAC Financial Data Classification

Regulators conducting a compliance review will expect the institution to produce a comprehensive evidence pack. The following table lists the documents needed, along with practical notes on format, ownership and retention.

Timeline and Key Deadlines for CAC Data Classification Compliance

The overall timeline for completing the data classification process depends on the institution’s size, system complexity and volume of third‑party relationships. The table below provides indicative end‑to‑end durations.

Phased Milestones

• Weeks 0–2 (Immediate). Governance setup, committee appointment, project‑plan sign‑off. This phase is purely organisational and should not be delayed.
• Weeks 2–10 (Early / Critical Path). Data inventory and flow mapping. This is invariably the longest single step and sets the critical path for the entire project. Institutions with fragmented or legacy systems should allow the full 8 weeks.
• Weeks 10–16 (Mid). Classification and grading committee sessions, DPIA completion and controls mapping. Steps 3 and 4 can be partially parallelised, the committee can begin grading the first tranche of datasets while IT starts DPIA work on datasets already graded.
• Weeks 10–22+ (Late / Parallel). Contract and vendor remediation (Step 5) runs in parallel from the moment the classification register identifies important or core data held by third parties. Vendor negotiations are the most unpredictable element; complex multi‑vendor remediations may extend to 12 weeks or longer.
• Post‑Classification (1–3 weeks). Compile and submit the important‑data catalogue to the CAC or sector regulator. Early indications suggest that regulators expect filing within one month of completing the classification exercise for datasets designated as important or core.
• Ongoing. Quarterly review of the classification register. Annual full reclassification. Dynamic updates whenever new data types are introduced or systems change.

Costs, Fees and Budget Considerations

Implementation costs vary significantly depending on system complexity, vendor count and whether the institution already has mature data‑governance tooling. The table below provides indicative budget ranges for planning purposes.

Most expenditure qualifies as operational rather than capital expenditure for accounting and tax purposes. However, significant technology deployments (e.g., new classification tooling platforms) may be capitalised under IAS 38 / PRC GAAP depending on the institution’s accounting policy. Institutions should confirm the treatment with their finance team and tax advisers.

What Changes in 2026: Key Developments in CAC Guidelines Financial Data

2026 marks the implementation year for financial data classification in China. The CAC’s January 2026 release of the draft Guidelines, followed by a public‑consultation period and a finalised version issued on 13 June 2026, consolidated what was previously a patchwork of sector rules and guidance notes into a single, enforceable framework. Key substantive changes include:

• Formal four‑tier grading system. The Guidelines codify the core / important / sensitive / general hierarchy for the first time in a single financial‑sector instrument, replacing ad‑hoc classification practices that many institutions operated under earlier DSL guidance.
• Explicit inventory and dynamic‑update obligation. Institutions must not only classify existing data but maintain living inventories with quarterly reviews and event‑triggered reclassifications, a significant upgrade from earlier one‑time assessment expectations.
• Important‑data catalogue filing. The CAC now expects institutions holding important or core data to compile and submit regulator‑ready catalogues, creating a new regulatory touch‑point that did not exist in prior guidance.
• Heightened DPIA and contractual standards. Institutions must complete DPIAs for all important‑ and core‑graded datasets and ensure that all third‑party and cross‑border processing agreements contain grade‑specific security obligations, audit rights and breach‑notification provisions. The ASIFMA industry submission noted that these contractual requirements will impose a substantial operational burden on institutions with large vendor networks.
• Tighter integration with PIPL and DSL enforcement. The Guidelines make explicit cross‑references to DSL penalties and PIPL enforcement mechanisms, signalling that classification failures may be pursued under existing, well‑established penalty regimes rather than requiring new enforcement instruments.

Common Pitfalls in CAC Financial Data Classification and How to Avoid Them

• Incomplete data inventory, missing shadow IT. Institutions routinely undercount their data assets because business units deploy ungoverned tools, spreadsheets and SaaS applications outside IT’s visibility. Mitigation: enforce centralised data‑discovery scans, cross‑reference against cloud‑access logs, conduct departmental interviews and run sample‑check audits post‑inventory to test completeness.
• Over‑grading or under‑grading datasets. Teams unfamiliar with the impact‑assessment criteria tend either to conservatively grade everything as important (inflating control costs) or to under‑grade strategically sensitive data to avoid DPIA obligations. Mitigation: require the classification committee to document a written rationale memo for every grading decision, adjudicate borderline cases at senior‑management level and calibrate decisions against peer‑institution benchmarks where available.
• Weak contractual protections for cross‑border processing. Many legacy vendor contracts pre‑date the 2026 Guidelines and lack grade‑specific security obligations, audit rights or breach‑notification timelines. Mitigation: maintain a standard contractual annex that can be appended to existing agreements, specifying data‑grading obligations, minimum security controls, on‑site audit rights and a 24‑to‑72‑hour breach‑notification requirement.
• Failure to preserve an auditable evidence trail. Producing documentation is insufficient if the institution cannot demonstrate that documents are versioned, signed off and retrievable. Mitigation: maintain a dedicated compliance evidence folder (physical or digital) with consistent file‑naming conventions, timestamps and sign‑off records for every deliverable.
• Missing periodic review deadlines. Classification is not a one‑time exercise. Institutions that complete the initial project but fail to embed quarterly reviews and event‑triggered reclassifications will fall out of compliance within months. Mitigation: set calendar triggers for quarterly reviews, assign ongoing ownership to the Data Governance Office and include classification‑review outcomes in internal audit scope.
• Delayed regulator notification after misclassification or incident. If an institution discovers that data has been misclassified, or that a security incident has affected important or core data, the DSL and PIPL require prompt notification to the relevant regulator. Mitigation: maintain a pre‑drafted notification template, establish an internal escalation SLA (decision to notify within 24 hours of discovery) and engage external counsel immediately for incidents involving important or core data. Penalties for non‑compliance under the DSL can include fines, ordered rectification, suspension of operations and personal liability for responsible individuals.

Sources

1. Linklaters, China: New guidance on classifying data and identifying important data in the financial industry
2. DataGuidance, China: Six authorities issue financial information service data classification guidelines
3. ASIFMA, Submission on Draft Guidelines on Data Classification and Grading for Financial Information Services
4. China Briefing, Key compliance signals from CAC’s January 2026 Q&A
5. Fangda Partners, PRC Financial Regulation Annual Report (2026) FinTech
6. Metomic, Data Classification for Financial Institutions