Chinese Regulators Publish New Model Cases on Network Data Security Protection

On January 16, 2026, the Shanghai office of the Cyberspace Administration of China (Shanghai CAC) published eight model cases relating to network data security protection. These cases highlighted regulators’ continued focus on data privacy and cybersecurity, and provided practical guidance on regulators’ interpretation of key laws and regulations, including the Cybersecurity Law (CSL, 网络安全法), the Personal Information Protection Law (PIPL, 个人信息保护法), the Data Security Law (DSL, 数据安全法), and the Regulation on Network Data Security Management (Regulation, 网络数据安全管理条例).

This Advisory summarizes the eight cases, which span three main enforcement areas: (1) network data security; (2) cross-border transfers; and (3) personal information protection. It concludes with questions for companies to consider when assessing their compliance posture.

Network Data Security Obligations

Under the CSL, DSL, the Regulation, and other relevant rules, data processors (akin to “controllers” under the European Union’s General Data Protection Regulation (EU GDPR)) must implement network data security measures, including:

1. Compliance with the requirements under China’s cybersecurity Multi-Level Protection Scheme (MLPS, 网络安全等级保护制度)¹

2. Establishing network data security management systems

3. Technical measures such as encryption, backup, access control, and security authentication to protect network data from being tampered with, damaged, leaked, or illegally accessed or used

A summary of the model cases relating to the failure to implement data security protection measures is below.

Cross-Border Transfers of Personal Information

Cross-border transfers of personal information continue to be a key enforcement area for Chinese regulators in recent years. Enforcement has focused on:

1. Whether the data processor undertook one of the three mechanisms promulgated by the PIPL for the cross-border transfer of personal information, including the Personal Information Protection Certification issued by Certification Institutions approved by Cyberspace Administration of China (CAC, 国家互联网信息办公室) (PIP Certification, 个人信息保护认证), Security Assessment performed by the CAC (Security Assessment, 数据出境安全评估), and filing the Standard Contractual Clauses (SCC Filing, 个人信息出境标准合同备案)

2. Whether the data processor completed a Personal Information Protection Impact Assessment (PIA) prior to the transfer, including assessment of the legality, legitimacy, and necessity of the purpose and method of personal information processing

3. Whether the data processor had informed the individuals and obtained separate consent prior to the transfer

A summary of the model cases relating to cross-border transfers of personal information is below.

Personal Information Protection

Article 22 of the Regulation provides that the collection of personal information must be necessary for providing products or services. Data processors are prohibited from collecting users’ personal information that exceeds the scope (1) necessary for providing products or services, or (2) for which data processors obtained users’ consent. Data processors are also prohibited from obtaining users’ consent through misrepresentation, fraud, coercion, or similar tactics.

A summary of the model cases relating to personal information protection is below.

Questions to Consider for Your Operations in China

As Chinese regulators continue to prioritize enforcement related to network data security, companies operating in China should proactively assess their compliance posture. Questions to address with internal stakeholders include:

1. Have we completed our MLPS self-assessment and filed with public security authorities where necessary?

2. For any cross-border transfers of personal information, have we completed one of the three lawful transfer mechanisms where necessary, and if there is any feedback or concern with the cross-border transfers, taken appropriate and timely remedial action?

3. Are our technical controls (e.g., encryption, access controls, identity verification) adequate for systems handling sensitive personal information?

4. Do our data collection practices align with necessity requirements, are we obtaining consent without pressure tactics or inducements, and do our privacy notices accurately describe our processing activities?

For questions on this or any other subject, please reach out to the authors or any of their colleagues in Arnold & Porter’s Privacy, Cybersecurity & Data Strategy practice group.

*Zhewen Zhang contributed to this Advisory.

© Arnold & Porter Kaye Scholer LLP 2026 All Rights Reserved. This Advisory is intended to be a general summary of the law and does not constitute legal advice. You should consult with counsel to determine applicable legal requirements in a specific fact situation.