SME Case Study

• Pages: 10-10

Take-away messages

；Be aware of the qualication as network operator or CII operator under the CSL and the corresponding obligations.

If you operate a website in China, you are likely to be considered a network operator and have the obligation to

follow the CSL rules.

；Ensure regular data protection compliance audit of the company. As legislation on cybersecurity issues is constantly

developing, it is important to follow legal developments and to keep yourself up-do-date with the recent changes.

；Be prepared in case of data security incidents. It is recommended to have a comprehensive incident response plan

and a communication plan.

；Report and communicate timely any data security incidents (internally and externally). Remember, you have the

obligation to notify the authorities of data security incidents, especially when handling personal and important data.

；Keep proper documentation on all the eorts on monitoring, auditing and responses. You might be asked to

provide evidence.

；To avoid the loss or leakage of sensitive data, it is recommended to encrypt data when transferred between your

oce in China and your headquarters in the EU.

；If you are planning to set up an R&D collaboration or conduct R&D activities in China and it is likely that you will

operate with sensitive data (personal data and important data), it is very important to address compliance issues

with Chinese regulations including the CSL beforehand.

；Use the assistance of a local lawyer/legal professional to guarantee compliance with the CSL measures as well as

other regulations. Consult a local lawyer/legal professional before setting up an R&D collaboration in China.

；Be sure to comply with all the CSL regulations when protecting trade secrets since they are the bare minimum level

of protection required by the Courts.

7. Take-away messages

Compliance with Cyber Security Law and

its impact on IP protection

10