每周数据法律资讯 Data Law Weekly（20260126—20260201）

MPS Cyberspace Security Bureau released “Law on the Prevention and Control of Cybercrime (Draft for Public Comment).” 《网络犯罪防治法（征求意见稿）》

On January 31, the Cybersecurity Bureau of the Ministry of Public Security released the “Law on the Prevention and Control of Cybercrime (Draft for Public Comment).” 《网络犯罪防治法（征求意见稿）》The draft consists of seven chapters and 68 articles, covering general provisions, management of network infrastructure resources, governance of cybercrime ecosystems, obligations for cybercrime prevention, prevention of cross-border cybercrime, and legal liabilities. It aims to prevent, curb, and govern cybercrime activities, safeguard national security, social stability, and cyber order, and protect the lawful rights and interests of citizens and organizations. Article 43 of the draft stipulates that network operators and data processors shall fulfill their obligations to protect network and data security. They must establish and improve network and data security management systems, adopt technical measures and other necessary actions to prevent their network services and data from being used for illegal or criminal activities. Processors of important data shall implement technical measures such as data tagging and labeling to monitor and identify the traceability chain of important data as it is transmitted between different entities.

[Reference:

https://mp.weixin.qq.com/s/vw-m36ddSXlDsbXSekdYQw]

CAC released Q&A on data outbound security management policies and regulations (January 2026)

On January 30, the Cyberspace Administration of China(CAC) released the “Q&A on Data Outbound Security Management Policies and Regulations (January 2026).” The Q&A addresses issues including: establishing standard contracts for personal information outbound transfers; coordinating personal information outbound certification with data outbound security assessment filings; and compliance obligations for domestic data processors who have established Guangdong-Hong Kong-Macao Greater Bay Area cross-border personal information flow standard contracts when their outbound circumstances change.

[Reference:

https://mp.weixin.qq.com/s/TPNHpZTcoFBdpBPB_anG4g]

3. 国务院发布《政务移动互联网应用程序规范化管理办法》

近日，国务院发布《政务移动互联网应用程序规范化管理办法》。《办法》旨在规范政务移动互联网应用程序管理，统筹为基层减负和赋能，防治“指尖上的形式主义”和政务服务中的“面子工程”。《办法》规定，政务应用程序上线前，主办（使用）单位应按照本办法规定履行备案程序，并在显著位置以醒目方式标示主办（使用）单位及备案编号。禁止以任何形式要求用户下载、安装或使用未经备案的政务应用程序。法律、行政法规另有规定的，依照其规定。

【参见：

https://mp.weixin.qq.com/s/9bXP86wCzzCfrb1QX_fBVw】

State Council issued “Measures for Standardized Management of Government Mobile Internet Applications”（《政务移动互联网应用程序规范化管理办法》）

Recently, the State Council issued the “Measures for Standardized Management of Government Mobile Internet Applications.”（《政务移动互联网应用程序规范化管理办法》）These Measures aim to regulate the management of government mobile internet applications, coordinate efforts to reduce burdens and empower grassroots levels, and prevent “finger-tip formalism” and “face-saving projects” in government services. The Measures stipulate that before launching a government application, the sponsoring (using) unit must complete the filing procedures as specified herein and prominently display the sponsoring (using) unit and filing number in a conspicuous manner. It is prohibited to require users to download, install, or use any unfiled government application in any form. Where laws or administrative regulations provide otherwise, those provisions shall prevail.

[Reference:

https://mp.weixin.qq.com/s/9bXP86wCzzCfrb1QX_fBVw]

4. “中国上海”门户网站数据出境专区正式上线

1月30日，上海市网信办在“中国上海”门户网站推出数据出境专区，为企业开展数据出境活动提供一站式、全链条服务。专区为上海市有数据出境需求的企业提供四大服务：政策文件集成化、政策解读精准化、咨询服务便捷化、申报系统直达化。

【参见：

https://mp.weixin.qq.com/s/rQzdE2yYPh3uo0njKMPdgw】

“China Shanghai” Portal launched dedicated data export zone

On January 30, the Shanghai Cyberspace Administration launched a dedicated Data Export Zone on the “China Shanghai” portal, providing enterprises with one-stop, full-chain services for data export activities. The zone offers four key services to Shanghai-based enterprises requiring data export: integrated policy documents, precise policy interpretation, convenient consultation services, and direct access to the application system.

[Reference:

https://mp.weixin.qq.com/s/rQzdE2yYPh3uo0njKMPdgw ]

5. 国标《数据安全技术基于个人请求的个人信息转移要求》获批发布

近日，推荐性国家标准GB/T46901-2025《数据安全技术基于个人请求的个人信息转移要求》获批发布。《数据安全技术基于个人请求的个人信息转移要求》规定了基于个人信息主体请求的个人信息转移的适用范围、前提要求、流程要求以及特定情形的其他要求，适用于指导个人信息处理者响应个人信息主体转移个人信息的请求，也为监管部门、第三方评估机构的相关监督、管理、评估活动提供参考。

【参见：

https://openstd.samr.gov.cn/bzgk/std/newGbInfo?hcno=50F585ED815873E9630EB382921742CD】

National Standard “Data security technology—Requirements for personal information transfer based on request of personal information subject” approved for release

Recently, the recommended national standard GB/T 46901-2025 “Data security technology—Requirements for personal information transfer based on request of personal information subject” was approved for release. This standard specifies the scope of application, prerequisite requirements, process requirements, and additional requirements for specific scenarios regarding personal information transfer based on the data subject's request. It applies to guiding personal information processors in responding to data subjects' requests for personal information transfer and also serves as a reference for regulatory authorities and third-party assessment bodies in their supervision, management, and evaluation activities.

[Reference:

https://openstd.samr.gov.cn/bzgk/std/newGbInfo?hcno=50F585ED815873E9630EB382921742CD]

6. 《道路机动车辆生产企业准入审查要求》和《道路机动车辆产品准入审查要求》修订内容发布，明确网络安全、数据安全等要求

工信部组织修订并于近日印发了《道路机动车辆生产企业准入审查要求》和《道路机动车辆产品准入审查要求》。其中，《企业审查要求》提高企业智能化、网联化相关能力要求，明确网络安全、数据安全、软件升级等通用要求，以及乘用车、货车、客车等生产企业组合驾驶辅助、自动驾驶等能力要求。《产品审查要求》加强车辆产品网络安全、数据安全、软件升级等管理要求。

【参见：

https://www.miit.gov.cn/zwgk/zcwj/wjfb/gg/art/2026/art_38716cc92c6047169da8a3ec84fa940a.html】

Revised “Requirements for Access Review of Road Motor Vehicle Manufacturers” and “Requirements for Access Review of Road Motor Vehicle Products” released, clarifying cybersecurity and data Security requirements

The Ministry of Industry and Information Technology (MIIT) recently revised and issued the “Requirements for Reviewing the Access of Road Motor Vehicle Manufacturers” and the “Requirements for Reviewing the Access of Road Motor Vehicle Products.” The “Manufacturer Review Requirements” elevate standards for manufacturers' capabilities in intelligent and connected vehicle technologies, specifying general requirements for cybersecurity, data security, and software updates. It also outlines capability requirements for manufacturers of passenger vehicles, trucks, and buses regarding combined driving assistance and autonomous driving systems. The “Product Review Requirements” strengthen management requirements for vehicle cybersecurity, data security, and software updates.

[Reference:

https://www.miit.gov.cn/zwgk/zcwj/wjfb/gg/art/2026/art_38716cc92c6047169da8a3ec84fa940a.html]

1.巴西和欧盟相互承认个人数据保护水平的充分性

1月27日，巴西与欧盟双方相互承认各自司法辖区所采用的个人数据保护水平具备充分性。在实践中，这意味着巴西和欧盟相互认可彼此的法律体系能够提供等效的个人数据保护，使得数据可以在两国之间直接、安全、简化地流动，而无需额外的数据跨境转移机制。

【参见：

https://www.gov.br/anpd/pt-br/assuntos/noticias/brasil-e-uniao-europeia-reconhecem-adequacao-mutua-em-protecao-de-dados-pessoais】

Brazil and the EU mutually recognize the adequacy of personal data protection levels

On January 27, Brazil and the European Union mutually recognized the adequacy of the personal data protection levels implemented within their respective jurisdictions. In practice, this means Brazil and the EU acknowledge each other’s legal systems provide equivalent personal data protection, enabling direct, secure, and simplified data flows between the two countries without requiring additional cross-border data transfer mechanisms.

[Reference:

https://www.gov.br/anpd/pt-br/assuntos/noticias/brasil-e-uniao-europeia-reconhecem-adequacao-mutua-em-protecao-de-dados-pessoais]

2. 欧盟委员会发布人工智能生成内容透明度行为准则初稿

近日，欧盟委员会发布了人工智能生成内容透明度行为准则初稿。根据《人工智能法案》第50条规定，服务提供商须以机器可读格式标识人工智能生成内容；而将生成式人工智能系统用于专业用途的用户，则需对涉及公共利益的深度伪造内容等进行明确标识，该准则旨在协助服务提供商和部署者提供满足这些要求。

【参见：

Commission publishes first draft of Code of Practice on marking and labelling of AI-generated content | Shaping Europe’s digital future】

European Commission released the First Draft Code of Practice on Transparency of AI-Generated Content

The European Commission recently published the First Draft Code of Practice on Transparency of AI-Generated Content. Under Article 50 of the AI Act, providers must mark AI-generated content in a machine-readable format. Users deploying generative AI systems for professional purposes must explicitly label deepfake content involving public interest. This code aims to assist providers and deployers in meeting these requirements.

[Reference:

Commission publishes first draft of Code of Practice on marking and labelling of AI-generated content | Shaping Europe’s digital future]

3. 法国国民议会通过法案禁止15岁以下未成年人使用社交媒体

1月27日，法国国民议会通过一项禁止15岁以下未成年人使用社交媒体的法案。根据法案内容，由在线平台提供的社交网络服务，将禁止15岁以下未成年人使用。法国总统马克龙同时表示，法案接下来将提交参议院审议，并已要求政府启动加速立法程序，力争让相关措施最早在下一个学年开始实施。

【参见：

https://api3.cls.cn/share/article/2270572?sv=8.7.2&app=cailianpress&os=android】

French National Assembly passed bill banning social media use for minors under 15

On January 27, the French National Assembly passed a bill prohibiting minors under 15 from using social media. Under the legislation, social networking services provided by online platforms will be barred to minors under 15. French President Emmanuel Macron stated that the bill will now be submitted to the Senate for review. He has instructed the government to initiate an accelerated legislative process, aiming to implement the relevant measures as early as the next academic year.

[Reference:

https://api3.cls.cn/share/article/2270572?sv=8.7.2&app=cailianpress&os=android]