The data security law, which goes into effect on Sept. 1, requires all companies in China to classify the data they handle into several categories and governs how such data is stored and transferred to other parties.

Key categories include "national core data" and "important data", for which mishandling could carry a penalties of up to 10 million yuan (US$1.54 million) or even a criminal charge. But the government has not yet provided definitions for these or given further details on what type of data may fall into which category, lawyers say.

For example, the law says only that companies looking to transfer "important data" overseas must perform a security assessment each time.

"There is no list, there is no annex, there are no examples," says Nicolas Bahmanyar, senior consultant at Beijing-based law firm LEAF. "So we’re a little bit in the dark here."

The country will also impose new rules aimed at protecting "critical information infrastructure," on the same day, but experts say definitions for such infrastructure are equally unclear.

Operators of critical information infrastructure will face stricter data security requirements, particularly when it comes to cross-border data transfers. Beijing in 2017 provided a list of industries that it considered critical in broad terms such as "public communications".

Popular

Ahok questions Agus' flood mitigation stance in first debate

K-pop group BTS to make comeback in February

Agus cash assistance plan slammed by Ahok, Anies