China to strengthen internet data center security

China on Tuesday released a notice on enhancing data security protection for Internet data center (IDC) customers, highlighting the critical role of robust IDC data security measures in safeguarding economic stability, social order and national security.

An IDC is a large-scale facility designed for the storage, processing, management and distribution of internet-related data and applications. 

The notice, issued by China's Ministry of Industry and Information Technology, offers specific guidance to IDC operators on strengthening customer data security protection.

It emphasized the need to clearly define the data security responsibilities and obligations of all parties, including customers and third-party service providers, in contracts and agreements, according to the nature and scope of the cooperation.

The ministry underscored the importance of establishing clear security policies and procedural mechanisms for critical aspects of data processing, including access, handling and destruction, and implementing protective measures like data isolation to enhance security.

Customers must be informed and their authorization obtained before undertaking high-risk operations that could impact data security or sharing customer data externally, according to the notice. 

Also, business continuity and stability should be strengthened through measures such as redundancy design, aligned with specific operational needs.

The ministry emphasized the need to establish a comprehensive customer data security management system, with designated data security officers and dedicated management departments, and implementing enhanced measures to protect customer data. 

A customer management framework will also be introduced, offering tailored security protection options based on customer categories and specific data protection needs.

Since the widespread adoption of the internet, global data resources have grown at an exponential rate. However, only about 20 percent of this data is transferable, while the remaining 80 percent comprises non-transferable information, including personal data, corporate secrets and national classified information, according to Zhang Xianghong, a professor at the International Center for Information Research, Beijing Jiaotong University, China's National Data Administration reported on Tuesday.

In 2020, China's data industry was valued at 1 trillion yuan ($140 billion), and by 2024, it is estimated to have reached 2.5 trillion yuan, representing a compound annual growth rate of 25 percent, according to the Securities Times.