TLDR; Below is the English-translated version of China’s Cybersecurity Review Measures (网络安全审查办法, Cyberspace Administration of China Order No. 8), published December 28, 2021 and in effect since February 15, 2022.
The Cybersecurity Review Measures govern when the procurement of network products and services by operators of critical information infrastructure (CII), and data-processing activities by network platform operators, must undergo a national-security review in China. They are the regime behind the headline rule that a network platform holding the personal information of more than one million users must apply for review before listing its securities abroad. They sit on top of the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law — the statutes that decide whether a given data or infrastructure arrangement is lawful in mainland China.
Cybersecurity Review Measures (Promulgated on December 28, 2021 by Order No. 8 of the Cyberspace Administration of China and twelve other departments; effective February 15, 2022)
Article 1. These Measures are formulated in accordance with the “National Security Law of the People’s Republic of China,” the “Cybersecurity Law of the People’s Republic of China,” the “Data Security Law of the People’s Republic of China,” and the “Regulations on the Security Protection of Critical Information Infrastructure,” in order to ensure the security of the supply chain of critical information infrastructure, safeguard cybersecurity and data security, and protect national security.
Article 2. Where critical information infrastructure operators procure network products and services, or network platform operators carry out data processing activities, that affect or may affect national security, a cybersecurity review shall be conducted in accordance with these Measures.
The critical information infrastructure operators and network platform operators referred to in the preceding paragraph are collectively referred to as “the parties.”
Article 3. Cybersecurity reviews adhere to combining the prevention of cybersecurity risks with the promotion of advanced-technology application, combining fairness and transparency of process with the protection of intellectual property, combining prior review with continuous supervision, and combining enterprise commitments with social oversight; review is conducted from the perspectives of the security of the products, services, and data processing activities and the national security risks they may entail.
Article 4. Under the leadership of the Central Cyberspace Affairs Commission, the Cyberspace Administration of China, together with the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, the Ministry of State Security, the Ministry of Finance, the Ministry of Commerce, the People’s Bank of China, the State Administration for Market Regulation, the National Radio and Television Administration, the China Securities Regulatory Commission, the National Administration of State Secrets Protection, and the State Cryptography Administration, establishes the national cybersecurity review working mechanism.
The Cybersecurity Review Office is located within the Cyberspace Administration of China and is responsible for formulating the relevant systems and norms for cybersecurity review and for organizing cybersecurity reviews.
Article 5. Where a critical information infrastructure operator procures network products and services, it shall assess in advance the national security risks that may arise after the product or service is put into use. Where national security is affected or may be affected, it shall declare the matter to the Cybersecurity Review Office for cybersecurity review.
The departments responsible for the security protection of critical information infrastructure in a given industry or field may formulate pre-assessment guidelines for that industry or field.
Article 6. For a procurement activity that is declared for cybersecurity review, the critical information infrastructure operator shall, through procurement documents, agreements, and the like, require the product or service provider to cooperate with the cybersecurity review — including commitments not to use the convenience of providing the product or service to illegally obtain user data or to illegally control or manipulate user equipment, and not to interrupt the supply of the product or necessary technical support services without legitimate reason.
Article 7. A network platform operator that holds the personal information of more than one million users and seeks to list its securities abroad must declare the matter to the Cybersecurity Review Office for cybersecurity review.
Article 8. When declaring a cybersecurity review, the party shall submit the following materials:
(1) a declaration form;
(2) an analysis report on how national security is or may be affected;
(3) procurement documents, agreements, the contract to be concluded, or the listing application documents to be submitted, such as those for an initial public offering (IPO);
(4) other materials required for the cybersecurity review.
Article 9. The Cybersecurity Review Office shall, within 10 working days of receiving review declaration materials that comply with Article 8 of these Measures, determine whether a review is necessary and notify the party in writing.
Article 10. Cybersecurity review focuses on assessing the following national security risk factors of the relevant object or situation:
(1) the risk that the critical information infrastructure is illegally controlled, interfered with, or sabotaged after the product or service is used;
(2) the harm to the business continuity of the critical information infrastructure caused by an interruption in the supply of the product or service;
(3) the security, openness, transparency, and source diversity of the product or service, the reliability of the supply channels, and the risk of supply interruption due to political, diplomatic, trade, or other factors;
(4) the product or service provider’s compliance with Chinese laws, administrative regulations, and departmental rules;
(5) the risk that core data, important data, or large amounts of personal information are stolen, leaked, damaged, or illegally used or illegally transferred outside China;
(6) the risk that, upon listing, critical information infrastructure, core data, important data, or large amounts of personal information are influenced, controlled, or maliciously exploited by foreign governments, as well as cyber information security risks;
(7) other factors that may endanger the security of critical information infrastructure, cybersecurity, or data security.
Article 11. Where the Cybersecurity Review Office considers that a cybersecurity review is necessary, it shall complete the preliminary review within 30 working days of issuing a written notice to the party — including forming a proposed review conclusion and sending it to the member units of the cybersecurity review working mechanism and the relevant departments for comment; in complex cases, this may be extended by 15 working days.
Article 12. The member units of the cybersecurity review working mechanism and the relevant departments shall reply with written comments within 15 working days of receiving the proposed review conclusion.
Where the member units and relevant departments are in agreement, the Cybersecurity Review Office shall notify the party of the review conclusion in writing; where they disagree, the matter shall be handled according to the special review procedure, and the party shall be notified.
Article 13. Where the matter is handled according to the special review procedure, the Cybersecurity Review Office shall solicit the opinions of the relevant units and departments, conduct an in-depth analysis and assessment, again form a proposed review conclusion, and solicit the opinions of the member units of the cybersecurity review working mechanism and the relevant departments; after reporting to and obtaining the approval of the Central Cyberspace Affairs Commission according to procedure, it shall form the review conclusion and notify the party in writing.
Article 14. The special review procedure shall generally be completed within 90 working days; it may be extended in complex cases.
Article 15. Where the Cybersecurity Review Office requests supplementary materials, the party and the product or service provider shall cooperate. The time taken to submit supplementary materials is not counted toward the review period.
Article 16. Network products and services and data processing activities that a member unit of the cybersecurity review working mechanism considers to affect or possibly affect national security shall be reviewed in accordance with these Measures by the Cybersecurity Review Office, after reporting to and obtaining the approval of the Central Cyberspace Affairs Commission according to procedure.
To guard against risk, the party shall, during the review, take measures to prevent and mitigate risk in accordance with cybersecurity review requirements.
Article 17. The relevant institutions and personnel participating in the cybersecurity review shall strictly protect intellectual property, and shall bear a duty of confidentiality with respect to commercial secrets and personal information they become aware of in the course of the review, undisclosed materials submitted by the party and the product or service provider, and other undisclosed information; without the consent of the party providing the information, such information shall not be disclosed to unrelated parties or used for any purpose other than the review.
Article 18. Where a party or a network product or service provider considers that review personnel have failed to be objective and fair, or have failed to bear the duty of confidentiality with respect to information learned in the course of the review, it may report this to the Cybersecurity Review Office or the relevant department.
Article 19. The party shall urge the product or service provider to honor the commitments made during the cybersecurity review.
The Cybersecurity Review Office strengthens pre-event, in-process, and post-event supervision through means such as accepting reports.
Article 20. Where a party violates the provisions of these Measures, the matter shall be handled in accordance with the provisions of the “Cybersecurity Law of the People’s Republic of China” and the “Data Security Law of the People’s Republic of China.”
Article 21. The network products and services referred to in these Measures mainly refer to core network equipment, important communications products, high-performance computers and servers, high-capacity storage devices, large databases and application software, cybersecurity equipment, cloud computing services, and other network products and services that have an important bearing on the security of critical information infrastructure, cybersecurity, and data security.
Article 22. Where state secret information is involved, the matter shall be handled in accordance with the relevant state secrecy provisions.
Where the state has separate provisions on data security review or foreign-investment security review, those provisions shall also be complied with.
Article 23. These Measures shall take effect on February 15, 2022. The “Cybersecurity Review Measures” promulgated on April 13, 2020 (Order No. 6 of the Cyberspace Administration of China, the National Development and Reform Commission, the Ministry of Industry and Information Technology, the Ministry of Public Security, the Ministry of State Security, the Ministry of Finance, the Ministry of Commerce, the People’s Bank of China, the State Administration for Market Regulation, the National Radio and Television Administration, the National Administration of State Secrets Protection, and the State Cryptography Administration) are repealed at the same time.
Closing
The original document was published in Chinese by the Cyberspace Administration of China; we translated it into English, which is what you read above. This translation is provided for quick comprehension only and should be used at your own discretion and risk — always confirm the current requirements with qualified legal counsel.
If you need further help from our team, contact us today, and our experts will help you keep your presence in China compliant from the ground up.
