Thread by @pstAsiatech

MIIT Notice on the "Data Security Management Measures in the Field of Industry and Information Technology (trial implementation)"
Sectoral clarification of Data Security Law #DSL application in industrial, ICT, and wireless sectors.
miit.gov.cn/jgsj/waj/wjfb/…

Cites prior art: Data Security Law, Cybersecurity Law, Personal Information Protection Law, National Security Law, Civil Code of the People's Republic of China.

Data processors in industry and information technology can be divided into industrial, telecommunications, and radio data processors. Data processing activities include but are not limited to data collection, storage, use, processing, transmission, provision, and disclosure.

According to degree of harm caused to national security, public interest, or legitimate rights/interests of individuals/organizations by tampering, destruction, leakage, illegal acquisition/use, data is divided into general data, important data, and core data.
重要数据和核心数据

Measures specify that when important or core data is provided to an outside party, both parties must sign a contract verifying that the receiver can appropriately protect the data. If core data is transferred, the provision of that data must be reported to the local MIIT branch.

Measures require that firms file important + core data catalogues with regulatory authorities, no timeline for this specified. Appears to be major compliance uncertainty--rules take effect on January 1, so not much time, assume some have prepared or there will be more time.