Supervisory inspections will verify compliance across network access filing, internal security management, data retention, multi-level protection, CII safeguards, technical defenses, vulnerability remediation, content controls, algorithm governance, data protection, and cooperation with authorities.

On-site inspections require two officers with police credentials and a written notice, emphasizing a limited number of visits.

Advisory and public advisories may be issued for identified risks; more serious risks may be escalated to government leadership, and formal interviews may occur for cybersecurity or data incidents.

Reciprocal accountability provisions hold police personnel and engaged contractors liable for misconduct such as unauthorized data access, trade secret or personal information disclosure, or abuse of powers.

Online monitoring requires three working days’ advance notice for capability testing; remote testing on non-CII facilities requires similar notice and non-disruptive operation, with findings shared with relevant regulators.

A heightened inspection regime targets operators tied to major security events, focusing on contingency planning, risk assessment, and incident reporting.

The Ministry of Public Security of China issued the Measures for Public Security Organs’ Supervision and Inspection of Cyberspace Security, effective October 1, 2026, replacing the 2018 provisions.

Qualified third-party technical providers may assist under police direction, subject to confidentiality, background checks, no fees charged to inspectors, and dual-signature records for inspections.

Entities subject to oversight include Internet service providers, public Internet access venues, network operators and contractors, CII operators, providers of network products and services, and data handlers; entities with prior incidents or penalties may face priority inspections.

Two inspection processes are established: online monitoring (network patrols, information-review testing, vulnerability scanning) and on-site inspections (county-level and higher authorities, with routine cap of one visit per year for MLPS Level 3+ networks and CII operators).

The new rules consolidate and modernize police authority to inspect compliance with cybersecurity, data security, and personal information protection regimes, aligning with major statutes such as the Cybersecurity Law, the Data Security Law, and the Personal Information Protection Law.