Data Security Law
A Chinese law and regulation concerning data security that sets compliance requirements for cross-border data transfer and code security, and that affects assessments of the domestic availability of AI programming tools.
Core Facts
Timeline (last 90 days)
Uploading source code to overseas servers may violate the Data Security Law or industry regulatory requirements, constituting a compliance red line for sensitive sectors such as finance and government affairs.
WorkBuddy uses a cloud inference architecture, and the instructions and file contents entered by users must be uploaded to remote servers for processing, which may constitute a compliance risk for organizations bound by the Personal Information Protection Law, the Data Security Law, or industry regulation.
Under China's legal framework, ID card numbers are classified as personal sensitive information, and unauthorized batch querying or storage carries legal risks, subject to the Data Security Law, the Personal Information Protection Law, and the Cybersecurity Law.
Bulk acquisition of merchant contact phone numbers for use in cold outbound calls may implicate the requirements of the Personal Information Protection Law regarding the lawful, legitimate, and necessary principles for personal information collection
Self-hosting allows enterprises to deploy Oats on an intranet server, ensuring that data flows entirely within their own infrastructure, making it suitable for industries regulated by GDPR or China's data security laws.
Regulations such as GDPR and the Data Security Law impose strict restrictions on cross-border data transfers, making data localization a hard requirement for customers in finance, healthcare, and government.
Bypassing anti-scraping mechanisms with web crawlers may violate a website's terms of service and potentially cross legal red lines under the Data Security Law and the Anti-Unfair Competition Law.
The EU GDPR constructs a rights framework centered on data subjects (individuals), China's Data Security Law and Personal Information Protection Law emphasize state sovereignty over important data, and the United States to this day lacks unified federal data protection legislation.
When using commercial remote desktop software, connection data may pass through relay servers located overseas, which may legally constitute cross-border data transfer and trigger compliance obligations under regulations such as GDPR and China's Data Security Law.
Under the Personal Information Protection Law and the Data Security Law, third-party software obtaining enterprise communication records requires explicit user authorization, and data processing must meet compliance requirements.
1 more timeline events
All Facts (13)
中国已实施《数据安全法》和《个人信息保护法》，对企业数据出境提出严格要求
80%VerifiedThe EU's GDPR, the US's HIPAA, and China's Data Security Law all impose strict restrictions on the cross-border transfer and third-party processing of sensitive data.
80%UnverifiedUnder the Personal Information Protection Law and the Data Security Law, third-party software obtaining enterprise communication records requires explicit user authorization, and data processing must meet compliance requirements.
60%UnverifiedChina's cybersecurity legal framework is primarily composed of three pillars: the Cybersecurity Law (2017), the Data Security Law (2021), and the Personal Information Protection Law (2021).
60%UnverifiedUploading source code to overseas servers may violate the Data Security Law or industry regulatory requirements, constituting a compliance red line for sensitive sectors such as finance and government affairs.
50%UnverifiedWorkBuddy uses a cloud inference architecture, and the instructions and file contents entered by users must be uploaded to remote servers for processing, which may constitute a compliance risk for organizations bound by the Personal Information Protection Law, the Data Security Law, or industry regulation.
50%UnverifiedUnder China's legal framework, ID card numbers are classified as personal sensitive information, and unauthorized batch querying or storage carries legal risks, subject to the Data Security Law, the Personal Information Protection Law, and the Cybersecurity Law.
50%UnverifiedBulk acquisition of merchant contact phone numbers for use in cold outbound calls may implicate the requirements of the Personal Information Protection Law regarding the lawful, legitimate, and necessary principles for personal information collection
50%UnverifiedSelf-hosting allows enterprises to deploy Oats on an intranet server, ensuring that data flows entirely within their own infrastructure, making it suitable for industries regulated by GDPR or China's data security laws.
50%UnverifiedRegulations such as GDPR and the Data Security Law impose strict restrictions on cross-border data transfers, making data localization a hard requirement for customers in finance, healthcare, and government.
50%UnverifiedBypassing anti-scraping mechanisms with web crawlers may violate a website's terms of service and potentially cross legal red lines under the Data Security Law and the Anti-Unfair Competition Law.
50%UnverifiedThe EU GDPR constructs a rights framework centered on data subjects (individuals), China's Data Security Law and Personal Information Protection Law emphasize state sovereignty over important data, and the United States to this day lacks unified federal data protection legislation.
50%UnverifiedWhen using commercial remote desktop software, connection data may pass through relay servers located overseas, which may legally constitute cross-border data transfer and trigger compliance obligations under regulations such as GDPR and China's Data Security Law.
50%