Key Facts
Overview
The DSL establishes a comprehensive data security governance framework with a classification system categorizing data as "core data," "important data," and general data. Each category carries corresponding security obligations and cross-border transfer restrictions. It is the third pillar of China's data governance framework alongside the PIPL and CSL.
What This Means for Your Website
- Data collected through your website must be classified under the DSL's grading system
- Important data processors must appoint data security officers
- Cross-border data transfers are subject to security review
- Regular risk assessments are required
- Cookie-specific consent is handled by the PIPL, not the DSL
Key Requirements
The CAC and sectoral authorities enforce the DSL with penalties including fines, business license revocation, and criminal liability. The data classification system determines the level of security obligations and cross-border restrictions. Important data processors have enhanced compliance requirements.
How ConsentStack Handles This
ConsentStack supports DSL compliance by ensuring data collected through consent mechanisms is handled according to classification requirements and security obligations.
Penalties
Varies by violation severity; includes fines, business license revocation, and criminal liability for serious offenses.
Key Requirements
- Data classification and grading system (core, important, general)
- Data security review system for cross-border transfers
- Important data processors must appoint data security officers
- Regular risk assessments required
- Data security incident reporting obligations
Notable Provisions
- Data classification system determines security obligations
- Part of China tri-pillar framework with PIPL and CSL
- Criminal liability for serious offenses
- Affects data storage and security, not consent mechanics
Other Asia Pacific Regulations
Frequently Asked Questions
What is the DSL data classification system?
The DSL categorizes data as core data, important data, and general data. Each category has corresponding security obligations and cross-border transfer restrictions.
Does the DSL address cookies?
No. Cookie-specific consent is addressed by the PIPL. The DSL focuses on data security governance, classification, and storage requirements.
How does the DSL relate to PIPL and CSL?
They form China's tri-pillar data governance framework: PIPL (personal data), CSL (cybersecurity), and DSL (data security).
Stay compliant with China DSL
ConsentStack helps you implement Opt-in consent for China automatically.