Privacy & Cybersecurity Law Blog

On August 6, 2026, the Ministry of Public Security of the People’s Republic of China (“MPS”) promulgated the Measures for Public Security Organs’ Supervision and Inspection of Cyberspace Security (the “New Rules on Cyberspace Inspection”). The New Rules on Cyberspace Inspection will take effect October 1, 2026, and replace the 2018 Provisions on Internet Security Supervision and Inspection by Public Security Organs, which are simultaneously repealed.

The main provisions include the following:

• Consolidation and modernization of the police’s authority to inspect compliance with China’s cybersecurity, data security, and personal information protection regime. This brings MPS’ enforcement practice closer into alignment with the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, the Critical Information Infrastructure (“CII”) Protection Regulation and the Network Data Security Management Regulation.
• Regulation of parties including Internet service providers, public Internet access venues, network operators and their contractors, CII operators, providers of network products and services, and data and personal data handlers. Entities that have previously experienced cybersecurity or data security incidents, or that have been subject to administrative penalties for failing to fulfill their statutory obligations regarding cybersecurity, data security, or information security and that have not made the required corrections, will be subject to priority oversight and inspection.
• Establishment of two inspection processes: online monitoring and on-site inspections. (1) Online monitoring covers network patrols, information-review capability testing, and vulnerability scanning. It can be conducted without disrupting normal business operations, though capability testing requires three working days’ advance notice. Prefecture-level and higher public security organs may also carry out remote technical testing, including vulnerability probing and penetration testing, against network facilities outside CII. This is subject to three days’ notice, and there must be no disruption to normal operations. The findings must be shared with the same-level cyberspace administration and relevant industry regulator. (2) By contrast, on-site inspections are reserved for county-level and higher authorities in the jurisdiction where the network operator is based. On-site inspections must involve at least two officers presenting police credentials and a written inspection notice. These inspections are capped at one routine visit per year for MLPS Level 3-and-above networks and CII operators.
• Conduct by MPS and its local counterparts of supervisory inspections to verify compliance with statutory obligations regarding cybersecurity, data security, and information security.
  • The inspection will focus on the following aspects: (1) network access filing; (2) internal security management systems; (3) retention of user registration and log data; (4) multi-level protection scheme compliance; (5) CII safeguards; (6) technical defenses against intrusion and malware; (7) remediation of known vulnerabilities; (8) content controls; (9) algorithm recommendation governance, (10) data and personal information protection; and (11) cooperation with police on national security, counter-terrorism, and criminal investigations.
• A heightened, targeted inspection regime applicable to operators connected to major security-guarantee events, focusing on contingency planning, risk assessment, and incident reporting.
• Based on the New Rules on Cyberspace Inspection, police engagement of qualified third-party technical service providers, but under police direction only. Such providers must be subject to confidentiality requirements and undergo background vetting, and no fees may be charged to inspected entities. Inspection records must generally be signed by both the inspecting officer and the responsible person of the entity being inspected, with any objections noted.
• Where risks are identified that do not constitute an actual violation, police issuance of advisory letters to the entity or its industry regulator. At the provincial level, they may also issue public advisories that do not name specific targets. More serious risks will result in escalation to government leadership. For cybersecurity or data security incidents, there is also the possibility of a formal interview with the entity’s legal representative or responsible person.
• Provisions for reciprocal accountability, which expose both police personnel and any engaged technical contractors involved to disciplinary or criminal liability for misconduct such as unauthorized data access, disclosure of trade secrets or personal information, or abuse of inspection powers.