By Josh Horwitz

BEIJING (Reuters) -China published new draft measures on Thursday aimed at bolstering its new data security law, including definitions of what it considered “core” and “important” data.

The Data Security Law, which China introduced on September 1, requires that all Chinese companies classify their data into different categories. It also governs the storage and transfer of such data to and from other countries.

But lawyers have criticised its ambiguities https://www.reuters.com/world/china/chinas-coming-data-laws-leave-firms-with-more-questions-than-answers-2021-08-27 including its lack of definitions for data.

Thursday’s draft measures outline in detail three kinds of data. They are ordinary data (important data), and core data.

According to the authorities, ordinary data refers to data which has little or no impact on society.

Important data refers to data that can pose a risk to China’s economy and national security or have an impact on the rights of people and organisations. It also includes data with an “obvious cascading affect” in a variety of businesses and industries.

Core data is data that “poses a serious threat to China’s economic and national interests.” The disruption of critical data can cause major damage, leading to large-scale service and network paralysis or shutdowns.

According to the regulator, organizations can “self-assess” their security but they must do annual assessments.

The rules stipulate that organizations must be approved for the cross-border transfer important and core data using a specific mechanism.

During the year-long crackdown on industry, data policy is one of many areas that regulators have focused their attention. China’s data security legislation builds upon the 2017 cybersecurity laws, which was the first set of major rules that govern the storage and transmission of Chinese-derived data.