In September 2024, the Standing Committee of the National People's Congress reviewed and passed the amendment to the Cybersecurity Law, which officially took effect on January 1, 2026. This revision marks the first major amendment to the Cybersecurity Law since its implementation in 2017. The core changes include significantly increasing penalties for violations, establishing a tiered and categorized penalty system, and expanding extraterritorial jurisdiction. For corporate cybersecurity officers, data security officers, and personal information protection officers, this revision signifies a substantial escalation in compliance pressure, with personal liability risks reaching unprecedented levels. This article will provide a detailed analysis of the key changes in the amendment and their practical implications for security officers.
The penalty tier system has been comprehensively upgraded.
The most significant change in the amendment is the establishment of a four-tier penalty system, which classifies violations based on their severity for graded penalties. The first tier applies to general violations, with fines ranging from 10,000 to 50,000 yuan, targeting minor first-time offenses that cause no actual harm. The second tier addresses violations that persist despite corrective orders from regulatory authorities, imposing fines of 50,000 to 500,000 yuan on the entity, along with penalties of 10,000 to 100,000 yuan on directly responsible personnel. The third tier covers violations resulting in serious consequences, with fines of 500,000 to 2 million yuan for the entity and penalties of 50,000 to 500,000 yuan for directly responsible personnel. The fourth tier deals with particularly severe violations, where fines can skyrocket to 2 million to 10 million yuan or up to 5% of the previous year's revenue. Compared to the pre-amendment maximum fine of 1 million yuan, the amendment increases the highest potential penalty for enterprises tenfold.
Individual Fines and Professional Bans
- ›The maximum individual fine has been increased to 1 million yuan: For directly responsible supervisors and other directly responsible personnel, fines ranging from 100,000 to 1 million yuan may be imposed in cases of particularly severe circumstances. ---ITEM--- Employment prohibition penalties: In cases of particularly severe circumstances, directly responsible supervisors may be prohibited from working in key positions related to cybersecurity management and network operations for a specified period. ---ITEM--- Comprehensive strengthening of the dual penalty system: Almost all penalty provisions simultaneously stipulate fines for both the organization and individuals, ensuring accountability is assigned to specific persons. ---ITEM--- Responsible personnel of critical information infrastructure operators face stricter individual penalty standards, with increased fine amounts.
Major Changes in Regulatory Enforcement Mechanisms
The amendment grants regulatory authorities greater enforcement powers and more flexible enforcement measures. The most notable change is that regulators can now impose penalties without prior warning. Before the amendment, enforcement practices typically followed a model of "first ordering corrections, then imposing penalties." The amendment explicitly stipulates that for violations that refuse to correct or lead to serious consequences, regulatory authorities can directly impose fines without going through the preliminary procedures of warning and ordering corrections. Additionally, the amendment strengthens the coordinating role of the Cyberspace Administration, granting it the authority to investigate and handle cross-departmental and cross-regional cybersecurity incidents. For cybersecurity violations involving critical industries such as public telecommunications and information services, energy, transportation, water resources, and finance, industry regulators and the Cyberspace Administration can conduct joint enforcement actions.
Expansion of Extraterritorial Jurisdiction
The amendment introduces extraterritorial jurisdiction provisions, extending its scope beyond national borders. It explicitly stipulates that overseas organizations and individuals engaging in activities that endanger the critical information infrastructure of the People's Republic of China or other activities that jeopardize China's cybersecurity, resulting in severe consequences, shall be held legally accountable. Public security departments and relevant authorities may impose measures such as freezing assets or other necessary sanctions against them. This provision enables China's cybersecurity laws to reach overseas actors, profoundly impacting the cybersecurity compliance strategies of multinational enterprises, particularly those handling data related to Chinese users or China's critical information infrastructure outside the country.
New Challenges Facing Security Leaders
- ›Pressure to justify compliance investments increases: The substantial rise in penalty ceilings makes the ROI of security investments more straightforward, but it also requires security leaders to more accurately assess compliance risks and prioritize investments. ---ITEM--- Emergency response timelines become stricter: Direct penalty mechanisms mean that companies must take remedial actions in the shortest possible time after discovering security incidents, as any delay could directly lead to hefty fines. ---ITEM--- Personal career risks rise significantly: The dual threats of individual fines up to 1 million yuan and professional bans substantially alter the risk-reward ratio for security leadership roles. ---ITEM--- Cross-border coordination complexity grows: The expansion of extraterritorial jurisdiction requires security leaders to possess stronger international legal perspectives and cross-border compliance coordination capabilities. ---ITEM--- The importance of evidence preservation and compliance records becomes prominent: Under the "direct penalty" enforcement model, comprehensive compliance records and continuous risk monitoring become critical evidence for corporate defense.
Recommended Corporate Response Strategies
In response to the new regulatory environment brought about by the 2026 amendments, companies should adopt proactive strategies. First, conduct a comprehensive assessment of the gaps between the existing cybersecurity compliance framework and the requirements of the amendments, and develop a remediation roadmap. Second, update internal security management systems and emergency response plans to ensure they meet higher timeliness requirements. Third, increase investment in security technologies, deploy continuous monitoring and automated response capabilities, and shorten the time window from incident detection to resolution. Fourth, provide security officers with adequate resources and authority support, including considering the purchase of D&O insurance to address personal liability risks. Fifth, strengthen compliance record management by establishing a comprehensive compliance audit trail system to ensure sufficient evidence of compliance can be provided during regulatory inspections. Finally, closely monitor the implementation rules and enforcement cases issued by industry regulatory authorities and adjust compliance strategies in a timely manner.
Amendment Timeline and Key Dates
- ›September 2024: The Standing Committee of the National People's Congress deliberated and passed the amendment to the Cybersecurity Law. ---ITEM--- October to December 2024: Industry regulatory authorities successively issued supporting implementation guidelines for the amendment. ---ITEM--- Throughout 2025: Transition period, with regulatory agencies focusing on education and guidance, but severe violations will still be penalized according to the law. ---ITEM--- January 1, 2026: The amendment officially takes effect, with new penalty standards fully applicable. ---ITEM--- First quarter of 2026: The first batch of penalty decisions based on the new standards is expected to be issued.
