The People's Bank of China published its Measures for Administration of Data Security in PBoC Business Areas on 9 May 2025, setting out data security obligations applicable to all entities conducting activities regulated by the central bank. The new rules take effect on 30 June 2025, giving the industry about seven weeks to prepare to align their systems and processes with the requirements.
The measures extend the PBoC's data security oversight to payment organisations, other institutions approved or recognised by the PBoC, and other institutions operating within the central bank's regulatory perimeter.
SCOPE AND REGULATORY COVERAGE
The measures apply broadly to any entity conducting business that falls within PBoC's supervisory remit, capturing not only commercial banks but also licensed payment companies, financial infrastructure operators, and other institutions approved or recognised by the PBoC.
China's Data Security Law and Personal Information Protection Law set baseline requirements for data handling across all industries.
For payment organisations, the measures introduce formal obligations around data classification, access control, incident reporting, and cross-border data transfer.
LEGAL LIABILITY
The measures include a legal liability chapter under which the PBoC and its branches can penalise violations in accordance with Article 45 of the Data Security Law, which provides for fines and, in serious cases, suspension of business or revocation of licences.