Data regulators clarify what “important” means
Business & Technology
A story from the The China Project A.M. newsletter. Sign up for free here.
The Ministry of Industry and Information Technology (MIIT) has published regulations clarifying how companies must handle data in order to abide by the new Data Security Law, which went into effect in September.
- The MIIT listed three types of data that companies must account for: “core data,” “important data,” and “ordinary data.”
- “Core data,” which companies are barred from moving out of China, is information that could pose a “serious threat” to the country’s “politics, territory, military, economy,” and a laundry list of other national security concerns.
- “Important data” is information that also poses a national security or economic threat, with “obvious cascading effects” across industries.
- “Ordinary data,” on the other hand, means the information has a “relatively small impact” on economic development and the legal interests of people and organizations.
Why it matters: After Beijing suspended Didi’s app this summer for data security reasons, companies and investors have been waiting to find out what constituted “core data” under the Data Security Law. Now, the rules are clearer.
- For U.S. companies in China, this means rethinking how localized data is handled; Elon Musk recently promised all the data Tesla generates in China will stay in China.
- For Chinese companies listed in the U.S., this means they may no longer be allowed to comply with U.S. audits, putting them at risk of being delisted.
