China: Network Data Security Risk Assessment Measures Take Effect

China's Cyberspace Administration (CAC) published authoritative Q&A guidance on August 20, 2026, the day the Measures for Network Data Security Risk Assessment (网络数据安全风险评估办法) entered into force, clarifying two obligations that bind every operator handling "important data" in the mainland. From today, important-data handlers must complete an annual network data security risk assessment and file the report with the competent regulator within 20 working days, while assessment institutions can apply for formal service certification through three accredited bodies. The Q&A, posted on the CAC's official site, is the first operational reading of how the Measures implement the 2025 Network Data Security Management Regulation (State Council Order No. 790).

The Measures sit one layer below that administrative regulation and above the three apex statutes that govern Chinese data, the Cybersecurity Law, Data Security Law and Personal Information Protection Law. They turn the Regulation's general risk-assessment duty into a concrete, dated procedure: who assesses, who certifies assessors, and where the report goes when the competent department is unclear.

Who must run the assessment, and by when is the report due?

Under Article 16 of the Measures, every "important-data handler" (重要数据处理者) must carry out a network data security risk assessment each year and submit the resulting report to its competent department within 20 working days of completion. The 20-working-day clock starts when the assessment is finished, not from a fixed calendar date, so handlers that have already begun their 2026 cycle must now map the deadline onto their internal schedule.

"Important data" is defined through the Data Security Law's classification-and-grading regime and the catalogue duties set out in the Network Data Security Regulation: sectors from automotive and cloud to fintech and pharmaceuticals that process data flagged as important by their sectoral regulator fall inside scope. Foreign-invested operators selling into the Chinese market, including connected-vehicle makers, cloud platform providers and cross-border payment firms, are bound on the same terms as domestic peers.

Where does an operator file when the competent department is unclear?

Article 16 anticipates that the competent department will not always be self-evident, particularly for operators spanning several regulated sectors. In that case the report goes to the provincial cyberspace administration (省级网信部门) or, at the national level, the CAC itself. The Q&A publishes a contact table of national and provincial cyberspace department phone numbers so handlers can confirm the correct filing channel before the window closes rather than after.

How can a risk-assessment institution obtain service certification?

Article 8 of the Measures encourages assessment institutions to obtain certification, administered under the PRC Certification and Accreditation Regulations. Three certification bodies have already filed the Data Security Risk Assessment Service Certification Rules (数据安全风险评估服务认证规则) with the National Certification and Accreditation Administration (CNCA): the CAC Data and Technology Assurance Center, the Ministry of Public Security Third Research Institute, and TAIR Certification Center. Assessment institutions may apply to any of them, and the certification is conducted against the filed rules and relevant standards.

For operators, the practical effect is a growing pool of accredited assessors; for assessment institutions, certification is now the documented path to credibility under these Measures, not a self-declared competence claim.

How do the Measures fit into China's existing data security framework?

The table below places the new instrument against the rules it operationalises and the adjacent regimes that remain in force.

Take advantage of this real-time watch

What to do next: confirm whether your operations process data classified as important under your sectoral catalogue; if so, stand up the annual assessment now and diarise the 20-working-day filing window from its completion; identify your competent department, or default to the provincial or national cyberspace administration using the Q&A contact table; and verify that any external assessor you commission holds or is pursuing certification under the filed rules. Obsidian's per-jurisdiction monitoring surfaces instruments like these at publication, not at the next quarterly review.