A Third Pillar for China's Data Security Regime
On June 1, 2026, China's Cyberspace Administration (CAC), the Ministry of Industry and Information Technology (MIIT), and the Ministry of Public Security (MPS) jointly issued the Measures for Risk Assessment of Network Data Security — Order No. 24 — which entered into force on August 20, 2026 (CAC, official text). It is the first data-security rule CAC has co-signed with both MIIT and MPS rather than issuing alone, and it operationalizes a duty that has existed only on paper since the Network Data Security Management Regulations took effect on January 1, 2025: that processors of "important data" must periodically assess the risk their own data handling creates (CAC Q&A).
The mechanism is self-assessment, not prior licensing. Important-data handlers must run a full risk assessment at least once a year, plus a targeted one whenever a material change — a new product line, a security incident, a shift in cross-border flows — could affect the security of that data, and file the resulting report with their sector regulator within 20 working days of completion (CAC). General-data handlers, by contrast, are merely encouraged to self-assess every three years — a voluntary tier that keeps the bulk of ordinary commercial data outside mandatory scope (Hunton Andrews Kurth).
What Changed Between Draft and Final
The rule went through a full consultation cycle — opened December 6, 2025, closed January 5, 2026 — and the final text is measurably lighter than the draft (Digital Policy Alert). The filing deadline was extended from 10 to 20 working days. Mandatory reporting templates were replaced with sector-specific guidance. Regulatory language shifted from provincial authorities "shall" require third-party assessment to "may" require it. And a quasi-whistleblower duty that would have had assessment institutions report directly to regulators was dropped — assessors now report only to their clients (GeoPoliTechs).
Assessors, meanwhile, face their own guardrail: the same third-party institution cannot audit the same data handler for more than three consecutive years, a rotation requirement aimed at preventing the kind of assessor capture that has dogged financial and environmental auditing elsewhere.
The Steelman
Beijing's stated rationale deserves a fair hearing. The CAC's own Q&A frames the measures as implementing the Data Security Law's periodic-assessment requirement while explicitly trying to reduce duplicative oversight — the document invokes preventing "unnecessary checks and cross-overlapping inspections" and assigning responsibility on a "who manages the business manages the business's data security" basis. That is a genuine problem in Chinese regulatory practice, where overlapping sectoral, provincial, and national mandates have historically produced redundant audits for the same company. A single, standardized annual assessment — self-run in the first instance, escalating to certified third parties only when regulators flag material risk — is a more proportionate instrument than the sweeping pre-clearance regimes China has used for cross-border data transfers. And a real safety case exists: China's Data Security Law was written in the aftermath of large-scale breaches and unregulated data brokering, and a jurisdiction with limited private-sector audit culture arguably needs a codified minimum bar for exactly this kind of self-review.
Where the Proportionality Argument Breaks Down
The unresolved problem is definitional, not procedural. "Important data" is not a term the Measures define — it is assigned through sector-by-sector catalogs that regulators are still in the process of publishing. A company cannot know with confidence whether it falls under the mandatory annual-assessment tier or the voluntary three-year tier until its industry's catalog exists, which means the compliance decision — hire assessors, build internal review capacity, budget for annual filings — has to be made against a moving target. That ambiguity falls hardest on mid-sized and foreign-invested firms without in-house China regulatory counsel, who will rationally over-comply (assessing data that was never "important" in the first place) rather than risk an enforcement gap they couldn't see coming.
The softening from draft to final — longer deadlines, discretionary rather than mandatory third-party review, no assessor-to-regulator reporting duty — is a genuine improvement and should be credited as such; regulators who visibly respond to consultation comments should be encouraged to keep doing it. But GeoPoliTechs' analysis flags the deeper structural issue precisely: the Multi-Level Protection Scheme, cross-border transfer security assessments, and this new annual risk-assessment regime remain three separate compliance tracks that are not operationally integrated, even though all three now touch overlapping datasets, including the AI training pipelines the Measures explicitly reach for the first time (excessive bulk collection, data poisoning, model memorization). Beijing's own stated goal — fewer, not more, duplicative inspections — will not be met until the important-data catalogs are finished and the three regimes are stitched into one filing process instead of three.
The Takeaway
This is regulation getting more proportionate at the margin while leaving its biggest source of compliance uncertainty untouched. Companies operating in China should treat the 20-day filing clock and the annual cadence as fixed now, but should not expect certainty on whether they are covered until sector catalogs land — and should watch whether CAC follows through on its own stated goal of consolidating overlapping data-security inspections into this single framework.