《数据安全法》英文版翻译发布

2021年6月10日，《中华人民共和国数据安全法》由中华人民共和国第十三届全国人民代表大会常务委员会第二十九次会议于2021年6月10日通过，并予以公布，自2021年9月1日起施行。

《数据安全法》是数据法的最重要的基础性法律之一，也具有域外效力。为了促进数据保护方面的国际交流与合作，推动与其他国家、地区、国际组织之间的数据保护规则、标准等的互认，基于此，DataLaws成立本译组，专门对《数据安全法》进行全文翻译，期待为数据法实务界及理论界的各位同仁提供参考。

借此向整理人李亚楠、帕格健及蒋月珍致敬，感谢她们对公益项目的无私奉献！

何渊，数据法盟主理人，上海交大数据法律研究中心执行主任

以下是《数据安全法》英译本全文：

Data Security Law of the People"s Republic of China

Chapter I: General Provisions

Article 1: This Law isformulated so as to regulate the handling of data, ensure data security,promote the development and exploitation of data, protect the legitimate rightsand interests of citizens and organizations, and preserve state sovereignty,security, and development interests.

Article 2: This law applies todata handling activities and security regulation carried out within the[mainland] territory of the People’s Republic of China.

Data handling activities carried outoutside the [mainland] territory of the P.R.C. that harming the nationalsecurity of the P.R.C., the public interest, or the lawful rights and interestsof citizens and organizations, are to be pursued for legal responsibility inaccordance with law.

Article 3: "Data" asused in this Law refers to any record of information in electronic or otherforms.

Data handling includes the collection,storage, use, processing, transmission, provision, disclosure, etc., of data.

Data security refers to employingnecessary measures to ensure that data is effectively protected and legallyused, as well as having the capacity to ensure a sustained state of security.

Article 4: The preservation ofdata security shall adhere to the overall national security perspective,establish and complete data security governance systems, andimprove data secureguarantee ability..

Article 5: The central leadinggroup on national security is responsible for major decision making and overallcoordination on national data security, research, draft, and guidance on theimplementation of a national data security strategy and major directives andpolicies,coordination of major matters and important work of national data security,and establishment of a national data security work coordination mechanism.

Article 6: Each region anddepartment bears responsibility for that region or department"s efforts on datacollection and production, as well as data security.

Regulatory departments such as forindustry, telecommunications, communications, finance, natural resources,health, education, science and technology are to undertake data securityregulatory duties in the corresponding sector.Publicsecurity organs, state security organs, and so forth are to undertake datasecurity regulation duties within the scope of their duties in accordance withthe provisions of this Law, relevant laws, and administrative regulations.TheState internet information departments are to take responsibility for theoverall coordination of online data security and relevant regulatory efforts inaccordance with this Law, relevant laws, and administrative regulations.

Article 7: The State is toprotect the rights and interests of individuals and organizations with regardsto data; encourage the lawful, reasonable, and effective use of data; ensurethe lawful and orderly free flow of data; and promote the development of adigital economy with data as a key factor.

Article 8: The carrying out ofdata handling activities shall obey laws and regulations, respect social moresand ethics, comply with commercial ethics and professional ethics, be honestand trustworthy, perform obligations to protect data security, and undertakesocial responsibility; it must not endanger national security, the publicinterest, or individuals" and organizations" lawful rights and interests.

Article 9: The state istosupport the dissemination of data security knowledge, raising the awarenessand level of data security protection of the whole society, pushing relevantdepartments, industry organizations, enterprises, and individuals to jointlyparticipate in efforts to protect data security, and forming a positiveenvironment for the entire society to jointly preserve data security andpromote development.

Article 10: Inaccordance with their charters and the law, relevant industry organizations areto draft specifications and group standards for data security activities,strengthen industry self-discipline, guide members to strengthen data securityprotections, increase the level of data security protections, and promote thehealthy development of the industry.

Article 11: Thestate is to actively carry out international exchanges and cooperation in thesectors of data security governance and data development and use, participatein the formulation of international rules and standards related to datasecurity, and promote the safe and free flow of data across borders.

Article 12: Everyindividual and organization has the right to make complaints or reports aboutviolations of this law to the relevant authorities.Departmentsreceiving complaints or reports shall handle them promptly in accordance with law.

The relevant authorities shall keeprelevant information of complaints, whistleblowers to be confidential, andprotect the legitimate rights and interests of complaints, whistleblowers.

Chapter II: Data Security andDevelopment

Article 13: Thestate is to make overall plans for development and security, persisting in onusingthe development and use of data and industry development to promote datasecurity, and using data security to ensure the development and use of data andindustry development.

Article 14: Thestate is to implement a big data strategy, advancing the establishment of datainfrastructure, and encouraging and supporting innovative applications of datain each industry and field.

People"s governments at the provincelevel or higher shall include the development of the digital economy in thepeople"s economic and social development plans for that level, and draftdevelopment plans for the digital economy as needed.

Article 15: The state istosupport the development and use of data to enhance the intelligence of publicservices. The provision of intelligent public services shall take full accountof the needs of the elderly and the disabled, and avoid creating obstacles totheir daily lives.

Article 16: Thestate is to support research into data use and development and data securitytechniques, encourage the spread and commercial innovation in areas such as theuse and development of data and data security, to foster and develop the useand development of data, data security products, and industrial systems.

Article 17: Thestate is to advance the establishment of a system of standards for datadevelopment and exploitation technologies and data security.Withinthe scope of their respective duties, the State Council departments in chargeof standardization and other relevant State Council departments are to organizethe formulation and appropriate revision of standards related to technology andproducts for the development and use of data and to data security. Thestate is to support enterprises and social groups, educational or researchbodies, and so forth, participating in drafting standards.

Article 18: Thestate is to promote the development of services such as data security testing,appraisals, and certification, and support professional institutions to carryout data security testing, appraisals, and certification service activities.

The state is to support collaborationamong relevant departments, industry organizations, enterprises, educationaland scientific research institutions, and relevant professional institutions indata security risk assessment, prevention, and disposal.

Article 19: Thestate is to establish and complete systems for data transactions andmanagement, regulating data transaction conduct, and fostering the datatransaction market.

Article 20: TheState is to support education, research institutions, enterprises, and soforth, in carrying out education and training related to data use anddevelopment and data security, employing diverse methods to cultivateprofessional data use and development and data security talent, and promote talent exchanges.

Chapter III: Data Security Systems

Article 21: Thestate is to establish a categorical and hierarchical system for data protectionand carry out categorized and graded data protections based on the importanceof the data in economic and social development as well as the extent of harm tonational security, the public interest, or the lawful rights and interests ofcitizens or organizations that would be caused once the data is altered,destroyed, leaked, or illegally obtained or used. The national data securitycoordination mechanism coordinates the relevant departments to determine acatalog of important data and strengthen protections of the important data.Datarelated to national security, the lifeblood of the national economy, importantpeople"s livelihood, major public interests and others belong to the nationalcore data, shall apply to a more stringent management system.

Each region and department shalldetermine the catalog of important data within that region and department andcorresponding industries and sectors on the basis of thecategorical and hierarchical protectionsystem, and conduct key protection for data entered in the catalog.

Article 22: Thestate is to establish a uniform, highly effective, and authoritative datasecurity risk assessment, reporting, information sharing, monitoring, and earlywarning system.The national data security coordination mechanism coordinatesthe relevant departments to strengthen the acquisition, analyses, assessment,and early warnings for information on data security risks.

Article 23: Thestate is to establish data security emergency response mechanisms.Relevantregulatory departments shall initiate emergency response plans in accordancewith law when data security incidents occur, employing the correspondingemergency response and handling measures to prevent the harm from increasingand eliminate security risks, and promptly issue relevant alerts to the public.

Article 24: Thestate is to establish systems for data security reviews and conduct nationalsecurity reviews of data handling activities that impact or might impactnational security. Security review decisions made in accordance with laware final decisions.

Article 25: Thestate is to implement export controls in accordance with law for data that arecontrolled items related to preserving national security and performinginternational obligations.

Article 26: Whereany nation or region employs discriminatory, restrictive, or other similarmeasures against the PRC in areas such as investment or trade in data andtechnology for the exploitation and development of data, the P.R.C. may employequal measures against that nation or region based on the actual circumstances.

Chapter IV: Data Security ProtectionObligations

Article 27: Thecarrying out of data handling activities shall be in accordance with laws andregulations, establishing and completing data security management systems forthe entire process, organizing and carrying out education andtrainingon datasecurity, and employing corresponding technical measures and other necessarymeasures to safeguard data security. The carrying out of data handlingactivities through information networks, i.e., the Internet, shall fulfill theduties to protect data security on the basis of the multi-level protectionsystem for cybersecurity.

Those processing important data shallclearly designate persons responsible for data security and data securitymanagement bodies to implement responsibilities for data security protection.

Article 28: Thecarrying out of data handling activities as well as research into newtechnology for developing data shall be conducive to promoting economicdevelopment, improving the well-being of the people, and complying with socialmores and ethics.

Article 29: Thecarrying out of data handling activities shall strengthen risk monitoring, andwhen data security flaws, vulnerabilities, or other risks are discovered,remedial measures shall be immediately employed; and when data securityincidents occur, methods for addressing them shall be immediately employed,users are to be promptly notified as provided, and reports are to be made tothe relevant regulatory departments.

Article 30: Thosehandling important data shall follow periodically carry out risk assessments oftheir data handling activities as provided, and send risk assessment reports tothe relevant regulatory departments. Risk assessment reports shall includethe types and amounts of important data being handled; the circumstances of thedata handling activities; the data risks faced, methods for addressing them,and so forth.

Article 31: Theprovisions of the Cybersecurity Law of the P.R.C. apply to the securitymanagement for exporting of data from the [mainland] territory that wascollected or produced by critical information infrastructure operators insidethe [mainland] territory of the PRC; security management measures for theexport of important data from the mainland territory that was collected orproduced by other data handlers within the [mainland] territory of the PRC areto be drafted by the State internet information department in conjunction withthe relevant departments of the State Council.

Article 32: Anyorganization or individual collecting data shall employ lawful and appropriatemethods and must not steal or obtain data through other illegalmethods. Where laws and administrative regulations have provisions on thepurpose or scope of data collection and use, data is to be collected or usedwithin the purpose and scope provided for in those laws and administrativeregulations.

Article 33: Wheninstitutions engaged in data transaction intermediary services provideservices, they shall require the party providing data to explain the sources ofthe data, verify the identities of both parties tothetranscation, and store arecord of the review and transaction.

Article 34: Wherelaws and administrative regulations provide that administrative license shallbe acquired for the provision of services related to data handling, serviceprovides shall obtain administrative license in accordance with law.

Article 35: Publicsecurity organs and state security organs collecting data as necessary tolawfully preserve national security or investigate crimes shall follow relevantstate provisions and complete strict approval formalities to do so, inaccordance with the law, and relevant organizations and individuals shallcooperate.

Article 36: Thecompetent PRC state organs shall under the provisions of laws and treaties oragreements concluded or participated in by the PRC, or under the principle ofequality and mutual benefits, handle the request of providing data by foreignjudicial or law enforcement agency. Without the approval of the competent PRCstate organs, organizations or individuals within the [mainland] territory of thePRC shall not provide data within the [mainland] PRC to foreign judicial or lawenforcement agency.

Chapter V: Government Affairs Data Security and Disclosure

Article 37: Thestate is to vigorously advance the establishment of e-governance, increasingthe scientific nature, accuracy, and efficacy of government affairs data, andincreasing the use of data in service of economic and social development.

Article 38: Stateorgans" performance of legally-prescribed duties that require the collectionand use of data shall be within the scope of the legally-prescribed duties andproceed in accordance with the requirements and procedures of laws andadministrative regulations; in the performance of duties to know personalprivacy, personal information, trade secrets, confidential business informationand other data shall be kept confidential in accordance with the law, and shallnot be disclosed or illegally provided to others..

Article 39: Stateorgans shall follow laws and administrative regulations to establish andcomplete data security management systems and implement responsibility for datasecurity protections to ensure the security of government affairs data.

Article 40: State organsentrusting others to establish or maintain electronic government affairs systemsor to store or process government affairs data, shall go through strictapproval procedures and shall oversee the performance of corresponding datasecurity protection obligations by the entrusted parties. The entrusted partyshall perform data security protection obligations in accordance with theprovisions of laws and regulations and contractual agreements, and shall notretain, use, disclose or provide government affairs data to others withoutauthorization.

Article 41: Stateorgans shall follow the principles of justice, fairness, and convenience forthe people, to promptly and accurately disclose government affairs data asprovided. Except for that which is not to be disclosed in accordance withlaw.

Article 42: Thestate is to draft a catalog of government affairs data to be disclosed, andbuild a uniform, regulated, interconnected, secure, and controllable platformfor disclosure of government affairs data and promoting the use of disclosedgovernment affairs data.

Article 43: Theprovisions of this chapter apply to the carrying out of data handlingactivities by organizations authorized by laws or regulations to have publicaffairs management duties in order to perform their legally-prescribed duties.

Chapter VI: Legal Responsibility

Article 44: Whererelevant regulatory departments performing data security oversight andmanagement duties discover that data handling activities have larger securityrisks, they may give the relevant organizations and individuals a talking andrequire to employ procedures, make corrections, and eliminate hidden dangers inaccordance with the authority and procedures provided.

Article 45: Where organizations orindividuals carrying out data handling activities do not perform the datasecurity protection obligations provided for in articles 27, 29 and 30 of thisLaw, the relevant regulatory departments are to order corrections and givewarnings, and may give a concurrent fine of between 50,000 and 500,000 RMB, andmay give directly responsible managers and other directly responsible personnela concurrent fine of between 10,000 and 100,000 RMB; where corrections arerefused or a large data leak or other serious consequences are caused, a fineof between 500,000 and 2,000,000 RMB is to be given, and they may be ordered tostop relevant operations, suspend operations for rectification, cancel relevantbusiness permits or licenses, and the directly responsible managers and otherdirectly responsible personnel are to be given a fine of between 50,000 and200,000 RMB.

Where organizations or individuals violate the core datamanagement system of the state, damage the sovereignty, security anddevelopment interest of the state, the relevant regulatory departments may givea fine of between 2,000,000 and 10,000,000 RMB and may order ordered to stoprelevant operations, suspend operations for rectification, cancel relevantbusiness permits or licenses; where a crime is constituted, criminalresponsibility is pursued in accordance with law.

Article 46：Where article 31 of this Law is violated by providing theimportant data to the overseas, the relevant regulatory departments are toorder corrections and give warnings, and may give a concurrent fine of between100,000 and 1,000,000 RMB, and may give directly responsible managers and otherdirectly responsible personnel a concurrent fine of between 10,000 and 100,000RMB; under serious circumstances, a fine of between 1,000,000 and 10,000,000RMB is to be given, and they may be ordered to stop relevant operations,suspend operations for rectification, cancel relevant business permits orlicenses, and the directly responsible managers and other directly responsiblepersonnel are to be given a fine of between 100,000 and 1,000,000 RMB.

Article 47: Where establishments engaged in services as intermediariesin data transactions fail to perform the obligations in article 33 of this Law,the relevant regulatory departments are to order corrections, confiscation theunlawful gains, and give a fine of between 1 and 10 times the value of theunlawful gains, or where there are no unlawful gains or the unlawful gains areless than 100,000 RMB, a fine of between 100,000 and 1,000,000 RMB is to begiven, and they may be ordered to stop relevant operations, suspend operationsfor rectification, or cancel related business permits or licenses; a fine ofbetween 10,000 and 100,000 RMB is to be given to the directly responsiblemanagers and other directly responsible personnel.

Article 48: Where article 35 of this Law is violated by refusal tocooperate with the collection of data, the relevant regulatory departments areto order corrections and give warnings，andmay give a concurrent fine of between 50,000 and 500,000 RMB, and give directlyresponsible managers and other directly responsible personnel a fine of between10,000 and 100,000 RMB.

Where article 36 of this Law is violated by providing data to anoverseas judicial or law-enforcement establishment without the approval orresponsible organs, the responsible authority is to give warnings, and may givea concurrent fine of between 100,000 and 1,000,000 RMB, and may give directlyresponsible managers and other directly responsible personnel a fine of between10,000 and 100,000 RMB；if there is any seriousconsequence, a fine of between 1,000,000 and 5,000,000 RMB is to be given, andthey may be ordered to stop relevant operations, suspend operations forrectification, cancel relevant business permits or licenses, and the directlyresponsible managers and other directly responsible personnel are to be given afine of between 50,000 and 500,000 RMB.

Article 49: Where state organs do not perform obligations to protectdata security as provided for in this Law, the directly responsible managersand other directly responsible personnel are to be given sanctions in accordancewith law.

Article 50: Where state personnel with duties for regulating datasecurity derelict their duties, abuse their authority or twist the law forpersonal gain, they are to be sanctioned in accordance with law.

Article 51: Where the carrying out of data handling activities steal or obtaindata through other illegal methods，eliminatesor restricts competition, or harms the lawful rights and interests of personsor organizations, punishment is to be given in accordance with laws andadministrative regulations.

Article 52: Where violations of the provisions of this law cause harm toothers, civil liability is borne in accordance with law.

Where provisions of this Law areviolated, constituting a violation of public security management, public securityadministrative sanctions are given in accordance with law; where a crime isconstituted, criminal responsibility is pursued in accordance with law.

Chapter VII: Supplementary Provisions

Article 53: The "P.R.C. Lawon the Protection of State Secrets" and other relevant laws andadministrative regulations are to apply to carrying out data handlingactivities involving state secrets. The carrying out of data handlingactivities in statistical work and archives work, and those involving personalinformation shall comply with laws and administrative regulations of protectingpersonal information.

Article 54: Methods for militarydata security protection are to be separately drafted by the Central MilitaryCommission on the basis of this Law.

Article 55: This Law shall takeeffect on September 1, 2021.