Revised CSL Draft

Below is a brief overview of the most recent developments and key takeaways from the revised draft of the Cybersecurity Law (“Revised Draft”[1]), issued on March 28, 2025 by the Cyberspace Administration of China (“CAC”). This marks the second public revision since the law became effective in June 2017 and reflects a concerted effort in 5 areas to enhance legal clarity and enforcement practices.

1.     Enhance Legal Framework Integration

a)       The Revised Draft aims to better align the Cybersecurity Law with other regulatory frameworks – including the Personal Information Protection Law and the Data Security Law – ensuring a cohesive approach to protecting national security, personal data, and public interests.

b)       It explicitly provides for smoother coordination between legal provisions, avoiding duplication while reinforcing regulatory consistency.

2.     Refine the Classification of Offenses and Tiers of Penalties

a)       The Revised Draft introduces a refined, three-tier scale for offenses: general offenses, aggravated cases, and particularly severe situations (e.g., massive data breaches or critical information infrastructure failures).

b)       Compared with the currently effective version, penalty ranges have been significantly raised. For instance, fines for network operators now range from modest amounts for initial breaches to substantially higher sums for severe consequences, with specific rules applicable to both enterprise and individual liabilities.

c)       The provision “violations shall be punished upon occurrence” revises the previous rule that penalties were only imposed after repeated violations, emphasizing direct accountability.

3.     Focus on Critical Information Infrastructure and Cybersecurity Products

a)       New provisions clarify that sales or provision of network-critical equipment and cybersecurity-specific products must meet mandatory security certification standards, and

b)       This move addresses a previous regulatory gap by explicitly establishing legal liability for distributing non-compliant or insecure products.

 4.     Strengthen Enforcement and Flexible Discretion

a)       The Revised Draft introduces a “leniency principle” in administrative penalties, allowing for reduced or waived penalties when operators proactively mitigate harm or promptly rectify breaches.

b)       Enhanced enforcement measures now include the potential for business suspension, license revocation, or mandated operational corrections, particularly for non-compliance that affects network integrity or national security.

5.     Emphasis on Platform Responsibility and Coordinated Governance

a)       There is a notable shift in the regulatory approach towards online platforms. Rather than imposing direct content-related penalties, the focus has shifted to strengthening overall compliance systems and robustness of internal controls.

b)       Operators are encouraged to develop technical and procedural safeguard measures, including user traceability and emergency response mechanisms, to effectively manage and mitigate risks.

Concurrent Regulatory Initiatives

A noteworthy development was, on the same day as the draft release, regulatory authorities launched this year’s special enforcement action plan[2] aims on personal information protection. This action covers mobile applications, SDKs, smart devices among other areas – signalling an intensified crackdown on data and cybersecurity related non-compliances.

In summary, the Revised Draft reflects a balanced approach between stringent penalties for serious breaches and more flexible measures for early remediation. Businesses are strongly encouraged to conduct a thorough review of their cybersecurity protocols and compliance frameworks, ensuring that internal management systems remain aligned with these evolving regulatory requirements. The consultation ends on April 27, 2025, and comments can be submitted via email or postal mail to the CAC.

Should you have any questions or require further analysis on how these changes may impact your operations, please do not hesitate to contact our team.

Data Protection Team

Global Law Office