China: Adoption of Enterprise Data Classification and Grading Standards in Tianjin Pilot Free Trade Zone

On 7 February 2024, the Municipal Commerce Bureau and Pilot Free Trade Zone Management Committee of Tianjin, China issued a notice regarding the "Enterprise Data Classification and Grading Standards and Specifications" for the China (Tianjin) Pilot Free Trade Zone. This is the first national standard specification for data classification and grading in Free Trade Zones (FTZs). The Standards classify enterprise data into 13 major categories and 40 sub-categories, dividing data into 3 levels: core data, important data, and general data, from highest to lowest security level. Important data is identified based on criteria like amount of personal data held, involvement of critical infrastructure operators, competitiveness impacts, and national security impacts. Core data is determined by national authorities. The Standards provide guidance for enterprises to carry out data classification and grading, with changes in data status requiring further filing. The Standards apply to the classification and grading of data generated, collected, stored, transmitted, and processed by companies based in the Tianjin FTZ during their production and operation processes. The Standards also provide that personal information will be deemed important data if it meets certain thresholds, in particular: personal information of more than 10 million people, sensitive personal information of more than 1 million people, or sensitive personal information of more than 100'000 people if it includes bank, insurance, registration accounts, medical records, etc. Other criteria such as the involvement of critical infrastructure entities, as well as public safety and stability, pricing power, and national security considerations, are considered to the ends of this classification.