每周数据法律资讯 Data Law Weekly（20250728-20250803）

1.中国人民银行与中国证监会联合发布《金融基础设施监督管理办法》

8月1日，中国人民银行与中国证监会联合发布《金融基础设施监督管理办法》。《管理办法》就金融基础设施的数据安全问题作出了相应规定。其中，第十五条要求金融基础设施运营机构建立完善的数据安全保护和数据备份措施、有效的网络安全管理制度与完备的数据存储管理机制。第十七条要求金融基础设施运营机构应当妥善保存金融基础设施服务的原始凭证和重要数据，以及与内部管理、业务经营有关的重要信息，保存期限一般应当不少于20年。第十八条要求金融基础设施运营机构应当加强数据安全管理，承担数据安全管理主体责任，建立和完善有效的内部数据安全管理制度和问责办法，对金融基础设施参与者的业务数据、相关资料，以及提供服务过程中产生的其他数据进行保护，确保数据不被损毁、非法窃取及非法使用，不得侵害个人信息权益。同时，金融基础设施运营机构应当为参与者及时获得与其相关的数据及资料提供便利。

【点击查阅《管理办法》全文：

http://www.pbc.gov.cn/tiaofasi/144941/144957/5798411/index.html】

The PBC and the CSRC jointly issued the “Administrative Measures for the Supervision of Financial Infrastructure”（《金融基础设施监督管理办法》）

On August 1, the People's Bank of China（PBC） and the China Securities Regulatory Commission（CSRC） jointly issued the “Administrative Measures for the Supervision of Financial Infrastructure.”（《金融基础设施监督管理办法》） The Administrative Measures make corresponding provisions on data security issues related to financial infrastructure. Among them, Article 15 requires financial infrastructure operators to establish sound data security protection and data backup measures, effective cybersecurity management systems, and complete data storage management mechanisms. Article 17 requires operators of financial infrastructure to properly preserve original documents and important data related to financial infrastructure services, as well as important information related to internal management and business operations, with a retention period generally not less than 20 years. Article 18 requires financial infrastructure operators to strengthen data security management, assume primary responsibility for data security management, establish and improve effective internal data security management systems and accountability mechanisms, and protect business data, relevant materials, and other data generated during the provision of services by financial infrastructure participants, ensuring that such data is not damaged, illegally obtained, or illegally used, and that personal information rights are not infringed upon. Additionally, financial infrastructure operators shall facilitate participants' timely access to data and materials related to them.

[Click to view the full text of the Administrative Measures:

http://www.pbc.gov.cn/tiaofasi/144941/144957/5798411/index.html]

2. 国家工业信息安全发展研究中心公开《工业领域重要数据识别指南》《工业企业数据安全防护要求》《工业领域数据安全风险评估规范》3项行业标准

8月1日，国家工业信息安全发展研究中心公开了其牵头编制的《工业领域重要数据识别指南》《工业企业数据安全防护要求》《工业领域数据安全风险评估规范》3项行业标准。《工业领域重要数据识别指南》给出工业数据处理者开展工业领域重要数据识别的基本原则、流程和考虑因素，适用于工业数据处理者开展工业领域重要数据识别工作，也可为行业监管部门制定工业领域重要数据目录提供参考。《工业企业数据安全防护要求》规定工业企业数据安全防护的基础性数据安全防护要求、数据全生命周期安全防护要求、其它防护要求，指导工业企业开展数据安全防护工作，也可为开展数据安全风险评估工作提供参考。《工业领域数据安全风险评估规范》规定工业领域数据安全风险评估的基本原则、要素、流程及方法，适用于工业领域重要数据和核心数据处理者在中华人民共和国境内开展数据处理活动的数据安全风险评估，也可用于指导工业领域一般数据处理者对其数据处理活动的数据安全风险评估。

【点击查阅标准全文：

https://mp.weixin.qq.com/s/033Adj72uAMkVfEBokDx4w】

The National Industrial Information Security Development Research Center released three industry standards: “Guidelines for the Identification of Important Data in the Industrial Sector,”（《工业领域重要数据识别指南》） “Data Security Protection Requirements for Industrial Enterprises,”（《工业企业数据安全防护要求》） and “Specifications for Data Security Risk Assessment in the Industrial Sector.”（《工业领域数据安全风险评估规范》）

On August 1, the National Industrial Information Security Development Research Center released three industry standards it had led in developing: YD/T 4981-2024 “Guidelines for the Identification of Important Data in the Industrial Sector,” （《工业领域重要数据识别指南》）YD/T 4982-2024 “Data Security Protection Requirements for Industrial Enterprises,”（《工业企业数据安全防护要求》） and YD/T 6415-2025 “Specifications for Data Security Risk Assessment in the Industrial Sector.”（《工业领域数据安全风险评估规范》）“Guidelines for Identifying Important Data in the Industrial Sector” provides basic principles, processes, and considerations for industrial data processors to identify important data in the industrial sector. It is applicable to industrial data processors conducting important data identification work in the industrial sector and can also serve as a reference for industry regulatory authorities in formulating important data catalogs for the industrial sector. “Data Security Protection Requirements for Industrial Enterprises” specifies the basic data security protection requirements, data security protection requirements throughout the entire data lifecycle, and other protection requirements for industrial enterprises. It guides industrial enterprises in conducting data security protection work and can also serve as a reference for conducting data security risk assessments. “Specification for Data Security Risk Assessment in the Industrial Sector” specifies the basic principles, elements, processes, and methods for data security risk assessment in the industrial sector. It is applicable to data security risk assessment for data processing activities conducted within the territory of the People's Republic of China by processors of important data and core data in the industrial sector, and may also be used to guide general data processors in the industrial sector in conducting data security risk assessment for their data processing activities.

[Click to view the full text of the standard:

https://mp.weixin.qq.com/s/033Adj72uAMkVfEBokDx4w]

3. 国家网信办就H20算力芯片漏洞后门安全风险约谈英伟达公司

7月31日，国家网信办发布公告称，为维护中国用户网络安全、数据安全，依据《网络安全法》《数据安全法》《个人信息保护法》有关规定，于当日约谈了英伟达公司，要求英伟达公司就对华销售的H20算力芯片漏洞后门安全风险问题进行说明并提交相关证明材料。此前，英伟达算力芯片被曝出存在严重安全问题。美议员曾呼吁要求美出口的先进芯片必须配备“追踪定位”功能。美人工智能领域专家透露，英伟达算力芯片“追踪定位”“远程关闭”技术已成熟。面对此次约谈，英伟达此后回应称：NVIDIA的芯片不存在“后门”，并不会让任何人有远程访问或控制这些芯片的途径。

【参见：

https://mp.weixin.qq.com/s/4SfjclOEbZOcus-TXc0KUw】

The CAC summoned NVIDIA Corporation for a meeting regarding security risks posed by backdoors in the H20 computing chip

On July 31, the Cyberspace Administration of China (CAC) issued an announcement stating that, in order to safeguard the cybersecurity and data security of Chinese users, in accordance with the provisions of the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law, it had summoned NVIDIA Corporation on the same day to explain the security risks associated with the backdoor vulnerabilities in its H20 computing chips sold to China and submit relevant supporting documents. Previously, NVIDIA's computing chips were reported to have serious security issues. U.S. lawmakers had previously called for advanced chips exported from the U.S. to be equipped with “tracking and location” features. U.S. artificial intelligence experts revealed that NVIDIA's graphics processing unit chips already possess mature “tracking and location” and “remote shutdown” technologies. In response to the meeting, NVIDIA stated: NVIDIA's chips do not contain any “backdoors” and do not allow any party to remotely access or control these chips.

[Reference:

https://mp.weixin.qq.com/s/4SfjclOEbZOcus-TXc0KUw]

4. 全国网安标委发布《未成年人产品和服务个人信息保护要求》等五项国家标准的征求意见稿

7月29日，全国网安标委发布《网络安全技术工业控制系统网络安全防护能力成熟度模型》《网络安全技术嵌入式操作系统安全规范》《网络安全技术操作系统安全技术规范》《网络安全技术移动互联网未成年人模式技术要求》《数据安全技术未成年人产品和服务个人信息保护要求》等五项国家标准征求意见稿。其中，《数据安全技术未成年人产品和服务个人信息保护要求》规定了未成年人产品和服务的个人信息保护原则和总则、个人信息处理要求、安全保护要求，以及新技术新应用相关的安全要求。

【参见：

https://www.tc260.org.cn/front/bzzqyjList.html?start=0&length=10】

The TC260 released drafts of five national standards, including the “Personal Information Protection Requirements for Products and Services for Minors” 《未成年人产品和服务个人信息保护要求》

On July 29, the TC260 released five national standards（draft version）which name “Cybersecurity Technology - Maturity Model for Industrial Control System Cybersecurity Protection Capabilities,”（《网络安全技术工业控制系统网络安全防护能力成熟度模型》）“Cybersecurity Technology - Security Specifications for Embedded Operating Systems,” （《网络安全技术嵌入式操作系统安全规范》）“Cybersecurity Technology - Security Technical Specifications for Operating Systems,”（《网络安全技术操作系统安全技术规范》）“Cybersecurity Technology - Technical Requirements for Minor Mode in Mobile Internet,”（《网络安全技术移动互联网未成年人模式技术要求》） and “Data Security Technology - Personal Information Protection Requirements for Products and Services for Minors.”（《数据安全技术未成年人产品和服务个人信息保护要求》）Among these, the “Data Security Technology: Personal Information Protection Requirements for Products and Services for Minors” specifies the principles and general provisions for personal information protection in products and services for minors, requirements for personal information processing, security protection requirements, and security requirements related to new technologies and applications.

[Reference:

https://www.tc260.org.cn/front/bzzqyjList.html?start=0&length=10]

5. 全国网安标委发布技术文件《政务大模型应用安全规范》（征求意见稿）

7月28日，全国网安标委发布技术文件《政务大模型应用安全规范》（征求意见稿）。文件将适用于政务大模型的选用、部署及运行活动，可为政务大模型应用安全提供指导。具体而言，文件对政务大模型的应用场景、模型选用、模型部署、模型运行和大模型安全防护栏功能要求进行了规定，同时提供了对应的测试指南。文件要求，不应将内部工作资料、敏感个人信息输入市场化大模型。

【参见：

https://mp.weixin.qq.com/s/PVCgnF7GorW_fBMJ88ZqHQ】

The TC260 released technical document “Security Specifications for the Application of Large Language Models in Government Services” (Draft for Public Comment) （《政务大模型应用安全规范》）

On July 28, the TC 260 released the technical document “Security Specifications for the Application of Large Language Models in Government Services” (Draft for Public Comment)（《政务大模型应用安全规范》）. The document will apply to the selection, deployment, and operation of large language models in government services, providing guidance for the secure application of such models. Specifically, the document specifies the application scenarios, model selection, model deployment, model operation, and security protection requirements for large models in government affairs, and provides corresponding testing guidelines. The document requires that internal working documents and sensitive personal information should not be input into market-based large models.

[Reference:

https://mp.weixin.qq.com/s/PVCgnF7GorW_fBMJ88ZqHQ]

6. 中央网信办规范“自媒体”医疗科普行为

7月28日，中央网信办等部门发布《关于规范“自媒体”医疗科普行为的通知》。《通知》要求网站平台应完善医疗“自媒体”账号资质认证工作，分类开展账号资质核查，在资质核验基础上清晰展示账号资质信息。网站平台应明确要求提供医疗科普内容的“自媒体”账号，严格标注医疗科普信息来源。《通知》要求网站平台应严处违法违规信息及账号。

【参见：

https://mp.weixin.qq.com/s/FfziFYspUc8-_j6L4l6XNw?click_id=6】

The CAC regulates medical science popularization activities by “Self-Media”

On July 28, the CAC and other departments issued the “Notice on Regulating Medical Science Popularization Activities by ‘Self-Media’.” The Notice requires website platforms to improve the qualification certification process for medical “self-media” accounts, conduct account qualification verification on a categorized basis, and clearly display account qualification information based on the verification results. Platforms must clearly require “self-media” accounts providing medical science popularization content to strictly label the sources of such information. The Notice also requires platforms to strictly handle illegal and non-compliant information and accounts.

[Reference:

https://mp.weixin.qq.com/s/FfziFYspUc8-_j6L4l6XNw?click_id=6]

1. 欧盟《人工智能法》关于通用人工智能模型的规定生效

欧盟《人工智能法》中关于通用人工智能（GPAI）模型的规定已于2025年8月2日生效。该等相关规定包括要求通用人工智能模型提供者应当编制并不断更新模型技术文件、向意图将通用人工智能模型纳入其人工智能系统的提供者提供相应信息和文件、制定符合欧盟版权法的政策、起草并公开有关用于通用人工智能模型训练的内容摘要。此外，如果是具有系统性风险的通用人工智能模型提供者，还需要履行模型评估、风险评估、风险事件报告和网络安全保护的义务。

【参见：

https://digital-strategy.ec.europa.eu/en/news/eu-rules-governance-start-apply】

Provisions of the EU Artificial Intelligence Act on General Purpose Artificial Intelligence models took effect

The provisions of the EU Artificial Intelligence Act on General Purpose Artificial Intelligence (GPAI) models took effect on August 2, 2025. These provisions include requirements for providers of general artificial intelligence models to develop and continuously update technical documentation for their models, provide relevant information and documentation to providers intending to integrate general artificial intelligence models into their artificial intelligence systems, establish policies compliant with EU copyright law, and draft and publish summaries of content used for training general artificial intelligence models. Additionally, providers of general artificial intelligence models posing systemic risks must fulfill obligations related to model assessment, risk assessment, reporting of risk incidents, and cybersecurity protection.

[Reference:

https://digital-strategy.ec.europa.eu/en/news/eu-rules-governance-start-apply]