China’s tough cybersecurity law comes into effect

China's controversial cybersecurity law, which requires international firms to store critical data within the country, has come into effect from today amid complaints from foreign businesses. The Cybersecurity Administration, the government body responsible for overseeing it, said a grace period of 19 months would be given for businesses to comply

The period starts on June 1 and continues until the end of the next year, Hong Kong-based South China Morning Post reported. Online service users will now have rights to ask service providers to delete their information if such information is abused.

The Cybersecurity management staff must also protect information obtained, and are banned from leaking or selling the information, including privacy and commercial secrets. Those who violate the provisions and infringe on personal information will face hefty fines.

The law is designed to safeguard China's cyberspace sovereignty, national security, public interest, as well as the rights and interests of citizens, legal persons and other organisations, the statement of the Cyberspace Administration of China (CAC) said.

"It does not restrict foreign companies or their technology and products from entering into the Chinese market, nor does it limit the orderly, free flow of data," the statement said. "China is entitled to make laws and rules to regulate its cyberspace sovereignty following international practice," it said.

Foreign firms grapple with China's "punitive" cybersecurity laws Michael Chang, vice-president of the EU Chamber of Commerce in China, said some key areas of the law would have a huge impact on the way business was done on the mainland.

A draft of the supporting regulations was released for public comment in April, while another draft measure on the definition of "critical information infrastructure" was released on Saturday. It is also unclear how such infrastructure will be protected.

The Cyberspace Administration met international stakeholders on May 19 and discussed the cross-border data movement regulations, offering the grace period, the Post report said.

Chen said the supporting regulations, including the cross border data transfer rules, would probably be finalised later this year because Beijing was determined to enforce the law.

The Cyberspace Administration said the cross-border data flow measures were not meant to disrupt email, e-commerce or other commercial activity. It also said the requirement that operators must stop transmitting "illegal information" would not jeopardise privacy or freedom of speech.