China’s Evolving Cybersecurity and Data Privacy Landscape: A 2025 Update

Introduction: A Complex and Ever-Changing
Regulatory Framework

China’s cybersecurity and data privacy landscape is one of the most complex and
rapidly evolving in the world. In 2025, the government has continued to refine and
expand its regulatory framework, issuing a series of new standards, guidelines, and
enforcement actions that have significant implications for all businesses operating
in the country. For international law firms and their clients, keeping pace with these
changes is a critical and ongoing challenge. A deep understanding of the legal
requirements and a proactive approach to compliance are essential for mitigating
risks and ensuring business continuity.

This article provides an update on the key developments in China’s cybersecurity
and data privacy landscape in 2025, including the latest on the Personal
Information Protection Law (PIPL), the Cybersecurity Law (CSL), and the Data
Security Law (DSL). It also offers practical guidance for companies on how to
navigate this complex regulatory environment and build a robust compliance
program.

Key Developments in 2025

The year 2025 has seen a number of important developments in China’s
cybersecurity and data privacy regime:

Increased Enforcement of the PIPL: The Cyberspace Administration of China
(CAC) and other regulatory bodies have stepped up their enforcement of the
PIPL, which came into effect in 2021. A number of high-profile enforcement
actions have been taken against companies for violations of the PIPL’s
provisions on consent, cross-border data transfer, and data subject rights.

New Standards and Guidelines: The government has issued a series of new
standards and guidelines to provide more detailed guidance on the
implementation of the CSL, DSL, and PIPL. These include standards on data
classification and grading, security assessments for cross-border data
transfers, and personal information protection in specific sectors such as
automotive and healthcare.

Focus on Critical Information Infrastructure (CII): The protection of CII has
been a key focus of the government’s cybersecurity efforts in 2025. The
authorities have issued new regulations that require CII operators to
implement enhanced security measures and to undergo regular security
assessments.

Implications for Businesses

The evolving cybersecurity and data privacy landscape in China has several
important implications for businesses:

Heightened Compliance Burden: The new standards and guidelines,
combined with the increased enforcement activities, have created a significant
compliance burden for businesses. Companies must invest in resources and
expertise to ensure that they are meeting all of the legal requirements.

Increased Data Localization Requirements: The trend towards data
localization is continuing, with the government requiring more and more data
to be stored within China. This can create significant challenges for
multinational companies that are used to centralizing their data in one
location.

Greater Scrutiny of Cross-Border Data Transfers: The rules on cross-border
data transfers have become more stringent, with companies now required to
obtain separate consent from individuals and to undergo a government-led
security assessment in many cases.

Best Practices for Compliance

To navigate the complex cybersecurity and data privacy landscape in China,
businesses should:

Appoint a Data Protection Officer (DPO): Companies that process a large
volume of personal information are required to appoint a DPO. The DPO is
responsible for overseeing the company’s data protection compliance
program and for liaising with the regulatory authorities.

Conduct a Data Protection Impact Assessment (DPIA): Before launching any
new product or service that involves the processing of personal information,
companies should conduct a DPIA to identify and mitigate any potential data
protection risks.

Implement a Comprehensive Data Security Program: Companies must
implement a comprehensive data security program that includes technical
and organizational measures to protect personal information from
unauthorized access, use, or disclosure.

Conclusion: A Long-Term Commitment to Data
Governance

China’s commitment to building a robust cybersecurity and data privacy regime is a
long-term and strategic one. For businesses, this means that compliance is not a
one-off project but an ongoing process of adaptation and improvement. By making
data governance a core part of their business strategy and by investing in the
necessary resources and expertise, companies can not only mitigate their risks but
also build trust with their customers and stakeholders in the world’s largest digital
market.