~ modifiedScope and effective date
- Previous rule summary
- The draft described domestic risk assessment, included a general other-rules proviso and left commencement blank.
- Compared rule summary
- The final Article 2 retains the domestic activity definition without that proviso; Article 25 sets 20 August 2026.
Practical impact: Use the final text for current procedures; do not infer that deletion displaces higher-ranking or sector rules.
Draft Articles 2, 25; final Articles 2, 25.
↔ proceduralCoordination and inspection
- Previous rule summary
- Draft Articles 3–5 used regional and departmental assessment/inspection plans and a provincial coordination layer.
- Compared rule summary
- Final Articles 3–4 establish a special inter-agency mechanism, annual inspection plans and coordination to avoid unnecessary or duplicate inspections.
Practical impact: The end-of-January plan is an authority duty, not the enterprise annual-report deadline. Official inspections cannot charge inspected important-data processors.
Draft Articles 3–5; final Articles 3–4.
i clarifiedAssessment cadence retained
- Previous rule summary
- Annual important-data assessment, change-triggered review and encouragement of a three-year general-data cycle.
- Compared rule summary
- Final Article 5 retains these three distinctions.
Practical impact: This row records continuity: do not turn encouragement into a mandatory three-year rule or wait for annual review after a qualifying change.
Draft Article 6; final Article 5.
~ modifiedMethodology and standards
- Previous rule summary
- The draft expressly named GB/T 45577 among applicable national standards.
- Compared rule summary
- Final Article 6 refers to relevant national standards without naming that standard and retains sector-specific provisions.
Practical impact: The deletion of the number does not abolish the standard; check current standards and the competent authority's sector rules.
Draft Article 7; final Article 6.
~ modifiedVoluntary engagement and certification
- Previous rule summary
- The draft preferred certified assessors in voluntary engagement and set out standards-based certification wording.
- Compared rule summary
- Articles 7–8 allow self-assessment or third-party engagement and encourage certification under the certification/accreditation regulation.
Practical impact: Do not claim all annual assessments require outsourcing to a certified assessor; authority-ordered certification is separately governed by Article 17.
Draft Articles 8–9; final Articles 7–8; implementation Q&A 1.
i clarifiedReport accountability and subcontracting
- Previous rule summary
- One article combined report truthfulness, validity, completeness and the ban on onward delegation.
- Compared rule summary
- Final Articles 10–11 separate those requirements; the prohibition remains.
Practical impact: Verify the actual performing institution; splitting the article does not relax accountability.
Draft Article 10; final Articles 10–11.
~ modifiedAssessor rotation
- Previous rule summary
- The draft prohibited three or more consecutive assessments by the same institution and its affiliates.
- Compared rule summary
- Final Article 12 specifies consecutive annual risk assessments of the same processor.
Practical impact: Track annual engagements and affiliate relationships; do not indiscriminately count every change-triggered review as an annual engagement.
Draft Article 11; final Article 12.
~ modifiedMajor-risk notification
- Previous rule summary
- The draft required notifying the processor and reporting to relevant authorities under applicable provisions.
- Compared rule summary
- Final Article 13 retains timely notice to the processor without that additional reporting sentence.
Practical impact: This textual deletion is not a waiver of incident-reporting duties under other laws or rules.
Draft Article 12(1); final Article 13.
~ modifiedAssessment information disposal
- Previous rule summary
- The draft required timely deletion after assessment.
- Compared rule summary
- Final Article 14 permits timely deletion or proper disposal as agreed in contract, while preserving confidentiality.
Practical impact: Specify lawful retention/disposal and access limits; distinguish working data from the report retained under Article 15.
Draft Article 12(2); final Article 14.
~ modifiedReport format and retention
- Previous rule summary
- The draft prescribed its annex template unless sector requirements provided otherwise; reports were kept at least three years.
- Compared rule summary
- Final Article 15 follows competent-authority provisions or permits reference to relevant standards where absent; the annex is not retained and three-year retention remains.
Practical impact: Do not publish the consultation form as a mandatory final template. Obtain the current receiving authority's report requirements.
Draft Article 13 and annex; final Article 15.
~ modifiedAnnual report submission
- Previous rule summary
- The processor submitted within 10 working days after annual assessment completion.
- Compared rule summary
- Final Article 16 changes this to 20 working days. If the competent authority is unclear, use provincial or national CAC.
Practical impact: Record completion and submission evidence. The authority's separate forwarding period remains 10 working days from receipt.
Draft Article 14; final Article 16; implementation Q&A 2.
~ modifiedCertified assessment ordered by authorities
- Previous rule summary
- The draft used a mandatory order and separate substantial-risk and national/public-interest grounds.
- Compared rule summary
- Final Article 17 uses a discretionary power and joins substantial risk with potential national/public-interest harm; the incident and other-stipulated grounds remain.
Practical impact: Read the actual trigger and order; the retained no-duplicate-demand rule concerns the same incident or risk.
Draft Article 15; final Article 17.
~ modifiedAccess, completion and rectification
- Previous rule summary
- The draft listed access permissions and express fee-bearing, plus signatures, stamp and a 15-working-day post-rectification report.
- Compared rule summary
- Final Article 18 specifies necessary access and omits the fee-bearing phrase; signatures, stamp and the post-rectification clock remain.
Practical impact: Deletion does not make commissioned work free. Fifteen working days follows rectification completion, not the initial finding.
Draft Article 16; final Article 18.
~ modifiedSupervision and information sharing
- Previous rule summary
- The draft's remedial language referred generally to network-data processors and specified a provincial end-of-March risk-handling return.
- Compared rule summary
- Final Article 19 targets important-data processing by important-data processors; Article 20 retains coordination without that dated provincial return.
Practical impact: Do not turn an omitted authority reporting arrangement into a business filing requirement; processor and assessor liability remains under Article 22.
Draft Articles 17–18, 20; final Articles 19–20, 22.
− deletedOverlapping-result mutual recognition
- Previous rule summary
- Draft Article 21 allowed mutual acceptance of overlapping risk assessment, MLPS testing, certification, PI audit and cryptography results.
- Compared rule summary
- No equivalent express mutual-recognition provision is carried into the final measures.
Practical impact: Useful evidence may still be reused where lawful, but this final instrument does not grant the draft's blanket cross-process acceptance.
Draft Article 21; compare final Articles 1–25.
− deletedPre-sharing assessment reference
- Previous rule summary
- Draft Article 22 allowed reference to these measures before providing, entrusting or jointly processing important data.
- Compared rule summary
- That standalone reference clause is not retained.
Practical impact: This is not repeal of underlying assessment duties for those activities in other controlling instruments.
Draft Article 22; compare final Articles 1–25.
+ addedCore data and cryptography
- Previous rule summary
- The draft preserved separate national arrangements for core-data assessment.
- Compared rule summary
- Final Article 23 retains that boundary and adds commercial-cryptography application security assessment for relevant important-data encryption measures under cryptography law.
Practical impact: Map the separate cryptography assessment where applicable; network-data assessment does not automatically replace it. Secrecy requirements also remain in Article 24.
Draft Articles 23–24; final Articles 23–24.