每周数据法律资讯 Data Law Weekly（20251229—20260104）

1. 新《网络安全法》和《个人信息出境认证办法》正式施行

2025年10月28日，第十四届全国人民代表大会常务委员会第十八次会议通过《全国人民代表大会常务委员会关于修改〈中华人民共和国网络安全法〉的决定》，自2026年1月1日起施行。《中华人民共和国网络安全法》根据该决定作相应修改并对条文顺序作相应调整，重新公布。2025年10月14日，国家互联网信息办公室、国家市场监督管理总局联合公布《个人信息出境认证办法》，自2026年1月1日起施行。

【参见：

https://mp.weixin.qq.com/s/1USxxi5RpXnU7QC2Sdl4Lw】

New “Cybersecurity Law” （《网络安全法》）and “Personal Information Cross-border Certification Measures” （《个人信息出境认证办法》）are officially enforced

On October 28, 2025, the 18th Session of the Standing Committee of the 14th National People’s Congress adopted the Decision of the Standing Committee of the National People’s Congress on Amending the “Cybersecurity Law of the People’s Republic of China”（《中华人民共和国网络安全法》）, effective January 1, 2026. The “Cybersecurity Law of the People’s Republic of China”（《中华人民共和国网络安全法》）was amended accordingly and republished with adjusted article sequencing. On October 14, 2025, the Cyberspace Administration of China and the State Administration for Market Regulation jointly promulgated “Personal Information Cross-border Certification Measures” （《个人信息出境认证办法》）, effective January 1, 2026.

[Reference:

https://mp.weixin.qq.com/s/1USxxi5RpXnU7QC2Sdl4Lw]

2. 中国网络空间安全协会发布完成个人信息收集使用优化改进App清单的公告（2025年第7批）

12月31日，中国网络空间安全协会发布公告称，协会组织指导输入法、手机银行、网络约车、学习教育和运动健身等5类5款App运营方，对照《中华人民共和国网络安全法》《中华人民共和国个人信息保护法》《常见类型移动互联网应用程序必要个人信息范围规定》等法律法规，重点针对超范围收集个人信息、过度调用敏感权限、权限设置和账号注销不便等个人信息收集使用问题完成了优化改进。5款App运营方已在应用商店或者官网上架优化改进版本，并承诺升级版本持续保持合规水平。

【参见：

https://mp.weixin.qq.com/s/dDghK2NduPtrutAhp4ykgg】

CSAC announced completion of list of apps optimized for personal information collection and use (Batch 7, 2025)

On December 31, the Cyber Security Association of China (CSCA) announced that it had guided operators of five apps across five categories—input methods, mobile banking, ride-hailing, education, and fitness—to optimize their personal information collection and usage practices. These improvements addressed issues such as excessive data collection, overuse of sensitive permissions, inconvenient permission settings, and cumbersome account cancellation procedures, in compliance with laws including the Cybersecurity Law of the People’s Republic of China, the Personal Information Protection Law of the People's Republic of China, and the Provisions on the Scope of Necessary Personal Information for Common Types of Mobile Internet Applications. The operators of these five apps have released optimized versions on app stores or their official websites and committed to maintaining compliance levels through ongoing updates.

[Reference:

https://mp.weixin.qq.com/s/dDghK2NduPtrutAhp4ykgg]

3. 上海网信办发布两期生成式人工智能服务已备案/登记信息

12月31日，上海网信办发布了一期上海市生成式人工智能服务已备案信息公告和一期上海市生成式人工智能服务登记信息公告。公告显示，截至12月31日，上海市新增1款已完成备案的生成式人工智能服务，累计已完成138款生成式人工智能服务备案；新增6款已完成登记的生成式人工智能服务，累计已完成145款生成式人工智能服务登记。

【备案信息参见：

https://mp.weixin.qq.com/s/yLXiR0jLOEs8D1KnGKYTRQ

登记信息参见:

https://mp.weixin.qq.com/s/NEk2nkeAmm6BFewq4u2xrA】

Shanghai Cyberspace Administration released two batches of generative AI service filing/registration information

On December 31, the Shanghai Cyberspace Administration released one batch of announcements regarding generative AI services that have completed filing in Shanghai and aonther batch of announcements regarding generative AI services that have completed registration in Shanghai. The announcements indicate that as of December 31, Shanghai has added one new generative AI service that has completed filing, bringing the cumulative total to 138 such services. Additionally, six new generative AI services have completed registration, bringing the cumulative total to 145 such services.

[For filing information, see:

https://mp.weixin.qq.com/s/yLXiR0jLOEs8D1KnGKYTRQ

For registration information, see:

https://mp.weixin.qq.com/s/NEk2nkeAmm6BFewq4u2xrA ]

4. 国家网信办公布三家通过备案的个人信息出境认证专业机构

12月30日，国家网信办发布公告称，落实《个人信息出境认证办法》第十二条规定，国家互联网信息办公室会同国家数据局完成中国网络安全审查认证和市场监管大数据中心、中央网信办（国家网信办）数据与技术保障中心、北京赛西认证有限责任公司3家机构的个人信息出境认证备案审核。个人信息处理者通过认证方式向境外提供个人信息的，可以向上述机构申请个人信息出境认证。

【参见：

https://www.cac.gov.cn/2025-12/30/c_1768735664909127.htm】

CAC announced three institutions approved for personal information cross-border certification

On December 30, the CAC issued an announcement stating that, in accordance with Article 12 of the Measures for Personal Information Cross-Border Certification （《个人信息出境认证办法》）, the CAC, in conjunction with the National Data Administration, has completed the review and approval of three institutions for personal information cross-border certification: the China Cybersecurity Review Certification and Market Supervision Big Data Center, the Data and Technology Support Center of CAC, and Beijing CESI Certification Co., Ltd. Personal information processors seeking to transfer personal information overseas through certification may apply for personal information cross-border transfer certification from the aforementioned institutions.

[Reference:

https://www.cac.gov.cn/2025-12/30/c_1768735664909127.htm]

5. 国家网信办发布《关于报送未成年人个人信息保护合规审计情况的公告》

12月29日，国家网信办发布《关于报送未成年人个人信息保护合规审计情况的公告》。《公告》显示，根据《未成年人网络保护条例》第三十七条的规定，个人信息处理者应当自行或者委托专业机构每年对其处理未成年人个人信息遵守法律、行政法规的情况进行合规审计，并向所在地设区的市级网信部门报送合规审计情况。处理未成年人个人信息的个人信息处理者，应当于每年1月底前报送上一年度未成年人个人信息保护合规审计情况。

【参见：

https://mp.weixin.qq.com/s/GpCeKPgtYQ1jB7KI7Mu6RQ】

CAC issued announcement on reporting compliance audit results for personal information protection of minors

On December 29, the Cyberspace Administration of China issued the announcement on reporting compliance audit results for personal information protection of minors. The Announcement states that pursuant to Article 37 of the “Regulation on the Protection of Minors Online”（《未成年人网络保护条例》）, personal information processors shall conduct annual compliance audits—either independently or through professional institutions—regarding their adherence to laws and administrative regulations when processing minors’ personal information. They must submit these audit results to the local municipal-level Cyberspace Administration Department. Processors handling minors’ personal information must report the previous year’s compliance audit findings by the end of January each year.

[Reference:

https://mp.weixin.qq.com/s/GpCeKPgtYQ1jB7KI7Mu6RQ]

6. 国家网络安全通报中心通报54款违法违规收集使用个人信息的移动应用

12月29日，国家网络安全通报中心对54款存在违法违规收集使用个人信息情况的移动应用进行了通报。这些移动应用存在的问题包括：未公开收集使用规则；未逐一列出收集、使用个人信息的目的、方式、范围；在申请打开可收集个人信息的权限时，未同步告知用户其目的；征得用户同意前就开始收集个人信息；实际收集的个人信息超出用户授权范围；配置文件中声明的可收集个人信息的权限超出相关功能的必要范围；实际收集的个人信息超出相关功能的必要范围；提前要求用户打开非当前功能所需的可收集个人信息权限；未向用户提供个人信息相关投诉渠道或功能；未向用户提供更正或补充其个人信息的具体途径；未向用户提供删除其个人信息的具体途径；未向用户提供注销账户的途径和方式；注销账户的流程中设置不合理的条件或提出额外要求；广告存在误导、欺骗用户行为。

【参见：

https://mp.weixin.qq.com/s/PmNx9dfw1_b5Y1awJlsfVg】

National Cybersecurity Reporting Center reported 54 mobile apps for illegal collection and use of personal information

On December 29, the National Cybersecurity Reporting Center issued a report on 54 mobile applications found to be illegally collecting and using personal information. Issues identified include: failure to disclose collection and usage policies; failure to itemize purposes, methods, and scope of personal information collection and use; failure to inform users of collection purposes when requesting permissions to access personal information; initiating personal information collection before obtaining user consent; collecting personal information beyond authorized scope; declaring permissions in configuration files exceeding functional necessity; collecting personal information beyond functional necessity; Requiring users to enable permissions for collecting personal information unrelated to the current function in advance; failing to provide users with complaint channels or functions related to personal information; failing to provide users with specific methods to correct or supplement their personal information; failing to provide users with specific methods to delete their personal information; failing to provide users with methods and means to cancel their accounts; setting unreasonable conditions or making additional demands during the account cancellation process; and engaging in misleading or deceptive advertising practices.

[Reference:

https://mp.weixin.qq.com/s/PmNx9dfw1_b5Y1awJlsfVg]

7. 生成式人工智能“幻觉”侵权纠纷案一审生效

12月29日，杭州互联网法院发布公告称，杭州互联网法院近期审结了梁某与某科技公司网络侵权责任纠纷一案，对“AI生成的不准确信息误导他人时，是否应承担侵权责任？”这一问题作出评判。该案中，法院认为生成式人工智能服务提供者应尽以下几个方面的注意义务：一是提供者应对法律禁止的有毒、有害、违法信息尽严格审查义务，除前述法律禁止的有毒、有害、违法信息外的其他一般性不准确信息，现行法律规范未对服务提供者科以必须确保信息准确的结果性审查义务；二是服务提供者应尽服务功能的显著提示说明义务，采取必要、合理的显著提示措施，使得用户能够了解、认知服务功能的局限性，并在特定情形下达到警示提醒的效果；三是服务提供者应尽功能可靠性的基本注意义务，采取同行业通行技术措施提高生成内容准确性。该案中，法院认为生成式人工智能生成的内容不能视为被告作出的意思表示，被告的案涉行为不具有过错，未构成对原告权益的损害，依法不应认定构成侵权。

【参见：
 

https://mp.weixin.qq.com/s/riMkHOiBhDra1xe70wQcRA】

First-Instance judgment takes effect in Generative AI “Hallucination” infringement dispute

On December 29, the Hangzhou Internet Court announced that it had recently concluded the case of Liang v. a technology company regarding online infringement liability. The ruling addressed the question: “Should generative AI bear liability for infringement when it misleads others with inaccurate information?” In this case, the court determined that providers of generative AI services bear the following duties of care: First, providers must exercise strict scrutiny over toxic, harmful, or illegal information prohibited by law. For other general inaccuracies beyond such prohibited content, current legal norms do not impose a result-oriented duty on service providers to ensure information accuracy. Second, service providers must fulfill a duty to provide prominent warnings and explanations regarding service capabilities, implementing necessary and reasonable prominent warning measures to ensure users understand and recognize the limitations of service functions, achieving a warning effect under specific circumstances. Third, service providers must exercise a basic duty of care regarding functional reliability, adopting industry-standard technical measures to enhance the accuracy of generated content. In this case, the court held that content generated by generative AI cannot be regarded as an expression of intent by the defendant. The defendant's actions in question were not negligent, did not constitute harm to the plaintiff's rights, and should not be legally deemed an infringement.

[Reference:

https://mp.weixin.qq.com/s/riMkHOiBhDra1xe70wQcRA]

8. 上海公安机关网安部门公布5起行政执法典型案例

12月29日，上海公安机关网安部门公布5起不履行网络安全、数据安全义务的行政执法典型案例。这五起案例涉及的违法行为主要为未采取技术防护措施导致存在数据安全风险隐患或被网络攻击，在现场检查过程中，公安机关还发现未建立全流程数据安全管理制度、未制定内部安全管理制度和操作流程、未确定网络安全负责人、未落实网络安全保护责任等问题。

【参见：

https://mp.weixin.qq.com/s/5WQYgX-Cl9QdrsE_2iib4g】

Shanghai Public Security Bureau’s Cybersecurity Department released five typical administrative enforcement cases

On December 29, the Shanghai Public Security Bureau’s Cybersecurity Department released five typical administrative enforcement cases involving failure to fulfill cybersecurity and data security obligations. The violations in these cases primarily involved failing to implement technical protective measures, resulting in data security risks or cyberattacks. During on-site inspections, authorities also identified issues such as lack of comprehensive data security management systems, absence of internal security protocols and operational procedures, failure to designate cybersecurity officers, and inadequate fulfillment of cybersecurity protection responsibilities.

[Reference:

https://mp.weixin.qq.com/s/5WQYgX-Cl9QdrsE_2iib4g]

1. 越南颁布《个人数据保护法实施细则》

12月31日，越南正式颁布《个人数据保护法（PDPL）实施细则》（第356/2025/ND-CP号法令），该法令详细规定了越南《个人数据保护法》实施的若干条款和措施，于2026年1月1日生效。法令明确了基础个人数据与敏感个人数据的详细清单、响应数据主体请求的相关要求、获得个人同意的方式、数据传输协议的必备内容、银行、征信活动、大数据处理、人工智能和虚拟世界、区块链技术、云计算等领域的数据保护要求、数据保护官及数据保护部门的任职资质、数据保护影响评估与数据传输影响评估的要求等。

【参见：

https://thuvienphapluat.vn/van-ban/Quyen-dan-su/Nghi-dinh-356-2025-ND-CP-huong-dan-Luat-Bao-ve-du-lieu-ca-nhan-687428.aspx】

Vietnam issued the Decree on Detailed Implementation Guidance for Personal Data Protection Law

On December 31, Vietnam officially promulgated the Decree 356/2025/ND-CP - Detailed Implementation Guidance for Personal Data Protection Law（PDPL）. This Decree specifies detailed provisions and measures for implementing Vietnam’s Personal Data Protection Law, effective January 1, 2026. The Decree clarifies: detailed lists of basic and sensitive personal data; requirements for responding to data subject requests; methods for obtaining personal consent; essential contents of data transfer agreements; data protection requirements for banking, credit reporting activities, big data processing, artificial intelligence and virtual worlds, blockchain technology, cloud computing, and other fields; qualifications for data protection officers and data protection departments; requirements for data protection impact assessments and data transfer impact assessments.

[Reference:

https://thuvienphapluat.vn/van-ban/Quyen-dan-su/Nghi-dinh-356-2025-ND-CP-huong-dan-Luat-Bao-ve-du-lieu-ca-nhan-687428.aspx]

2. 美国加州数据泄露：客户通知法案（SB446）正式生效

2026年1月1日，加州《数据泄露：客户通知法案》生效，该法案于2025年10月3日由加利福尼亚州州长签署。该法案的核心目标是明确和强化加州现有的数据泄露通知义务，通过将原来的模糊时间要求转为具体的通知期限，从而强化消费者对数据安全事件的知情权。该法案要求在发现或接到数据泄露通知后，企业必须在 30 个日历日内向受影响的加州居民发出通知。

【点击查阅法案全文：

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB446】

California Data Breaches: Customer Notification Act (SB446) officially takes effect

On January 1, 2026, California's Data Breaches: Customer Notification Act takes effect. The Act was signed by the Governor of California on October 3, 2025. Its core objective is to clarify and strengthen California's existing data breach notification obligations by replacing vague timeframes with specific notification deadlines, thereby enhancing consumers' right to know about data security incidents. The Act mandates that businesses must notify affected California residents within 30 calendar days of discovering or being notified of a data breach.

[Click to view full text of the law:

https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB446]