China’s Data Security Law, adopted on 10 June 2021 and effective from 1 September 2021, addresses data processing and safeguards across sectors. Below are independently translated selections relevant to organizations handling business, HR and payroll information. They do not replace separate duties under China’s Personal Information Protection Law or Cybersecurity Law.
Chinese original: 中华人民共和国数据安全法（2021年）. Verified against source: 26 October 2026. Translation prepared independently from Chinese; not the full law or certified legal advice.
Table of Contents
Meaning of data processing — Articles 2–3
Selected provision, independently translated: The law applies to data processing in China and its security oversight; certain processing outside China that harms protected national interests or rights can also carry liability. Data are records of information in electronic or other form. Processing includes collection, storage, use, processing, transmission, provision and publication.
Employer implication: Map HR and payroll data handling to actual activities, not simply where the software provider is located.
Classification and key-data framework — Articles 21–22
Selected provision, independently translated: The state establishes data classification and graded protection, with stronger protection for important data and core state data under applicable schemes.
Employer implication: Do not assume every personnel record automatically has the same legal classification; verify sector and authority-specific rules.
Security governance — Article 27
Selected provision, independently translated: A data handler must establish and improve security systems covering the entire processing lifecycle, arrange appropriate education and training, and adopt technical and other safeguards. When processing important data, it must identify responsible personnel and a management body as required.
Employer implication: Define security ownership, access controls, vendor responsibilities and training records.
Monitoring and incident response — Article 29
Selected provision, independently translated: Data handlers must monitor security risks and take timely corrective action upon finding weaknesses or vulnerabilities. When a data security incident occurs, they must respond promptly and notify affected users and relevant authorities as required.
Employer implication: Develop a documented incident-response workflow without inventing one universal notification deadline.
Important-data risk reports — Article 30
Selected provision, independently translated: Processors of important data are required to conduct periodic risk evaluations and submit risk assessment reports to relevant supervisory authorities as prescribed. The report covers types and volumes of important data, processing activities, risks and responsive measures.
Employer implication: Whether HR data qualifies as important data needs independent verification, not assumption.
Cross-border transfer and lawful collection — Articles 31–32
Selected provision, independently translated: The law establishes specific treatment for overseas transfers of important data produced or collected in China, and requires organizations to collect data by lawful and proper means within legally defined purpose and scope.
Employer implication: Evaluate applicable transfer rules together with other data laws and sectoral requirements.
Requests from foreign authorities — Article 36
Selected provision, independently translated: Requests by foreign judicial or law-enforcement bodies for data stored in China are addressed through Chinese competent authorities under applicable law and treaties or reciprocal arrangements. Without the approval required from the competent Chinese authority, organizations in China may not provide such data directly to those foreign bodies.
Employer implication: Escalate cross-border disclosure requests to qualified legal counsel instead of routinely exporting employee records.
Primary source: Official Chinese text. Related HROne guide: China Labor Law.
These excerpts are not a complete substitute for statutory requirements, later implementing rules or advice on a particular case.
