Since the implementation of Cybersecurity Law of the People’s Republic of China (the “Cybersecurity Law”, or the “Law”) on June 1, 2017, a series of supplementary implementing measures were publicized in succession. Under current regulations, all applicable enterprises in China shall, promptly formulate or update their internal cybersecurity systems to ensure cybersecurity compliance. To help applicable enterprises better understand their compliance obligations under the implementation rules, we analyze relevant legal framework of the Cybersecurity Law and put forward some practical suggestions.

1. Applicable subjects under the Cybersecurity Law
Any company that “builds, operates, maintains, and uses the Internet” in the territory of People’s Republic of China (“PRC”) is subject to the Cybersecurity Law. Specifically, the Cybersecurity Law applies to “network operators”, which cover “network owners, administrators and network service providers”. Among all the network operators, some are referred to as “critical information infrastructure operators” (“CIIO”). CIIOs are network operators mainly related to public communication and information services, energy, transportation, water conservancy, finance, public services, e-government, etc. Readers should note that providers of network products and services, and any individual, enterprise and social organization which use interactive information systems to communicate should also comply with the Cybersecurity Law.