China Data Security Law

PRC Data Security Law - data classification, important data, security review for cross-border transfer.


Short name	DSL CN
Region	Asia-Pacific
Country or scope	China
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers DSL CN

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for DSL CN.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for DSL CN and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`CN-DSL-21` Data Classification Foundation	The state implements classified and graded data protection, and classifying data by system requires an enumerated inventory of the software components that process it (Data Security Law Art. 21)	Scan
`CN-DSL-27-SEC` Whole-Process Security Measures	Data processors must establish a sound data security management system across the full workflow and adopt corresponding technical measures, including integrity assurance for the software stack handling data (Data Security Law Art. 27)	Scan
`CN-DSL-27-RESP` Designated Security Responsibility	Processors of important data must designate a data security responsible person and management body, so security documentation must record an accountable contact (Data Security Law Art. 27)	Scan
`CN-DSL-29` Risk Monitoring and Flaw Remediation	Data processors must strengthen risk monitoring and immediately remediate discovered security flaws and vulnerabilities, which requires knowing the exact version of every deployed component (Data Security Law Art. 29)	Scan
`CN-DSL-30` Periodic Risk Assessment Reports	Processors of important data must conduct periodic risk assessments and submit reports to the competent authority, requiring dated, identifiable machine-readable records as evidence (Data Security Law Art. 30)	Scan
`CN-DSL-29-ID` Vulnerability Traceability	Effective risk monitoring depends on matching deployed components against published vulnerability advisories, which requires standard component identifiers such as PURL or CPE (Data Security Law Art. 29)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`DSL-21`	Data Classification System
`DSL-27`	Data Security Management System
`DSL-28`	Third-Party Risk Management
`DSL-31`	Cross-Border Data Transfer Controls
`DSL-32`	National Core Data Protection
`DSL-34`	Data Security Review
`DSL-35`	Government Data Opening Standards
`DSL-36-39`	Government Data Management Obligations

Policy templates

Written for DSL CN:

PRC Data Classification & Grading Policy

And 22 from the standard set, adapted to DSL CN.