Chongqing implements new data security management regulations

Chongqing has passed the “Chongqing Municipal Data Security Management Regulations,” which are set to take effect on September 1, 2026. This legislation serves as the first systematic local regulation in China to govern the entire lifecycle of data security.

The regulations establish a comprehensive management responsibility system, clarifying the duties of various departments to prevent overlapping jurisdictions. Key features include a classification and grading system for data protection, ensuring that important data is identified and managed with heightened security protocols.

To ensure accountability, the regulations mandate specific log retention periods: general data processing logs must be kept for at least six months, while logs involving internet government applications or important data security incidents must be kept for at least one year. For cases involving the provision or processing of important personal information, logs must be retained for no less than three years. Additionally, entities handling important data must undergo annual risk assessments conducted by themselves or third-party agencies.