The Regulation tightens the data processing security valve from the aspects of collection, storage, use, processing, transmission, provision, disclosure, induction, deletion, and destruction, providing a solid legal guarantee for promoting the construction of digital Chongqing and exploring modern governance of mega cities.

In terms of clarifying responsibilities, the Regulation clarifies the supervisory responsibilities of six major functional departments and establishes a three-dimensional regulatory system: the municipal national security leadership agency is responsible for coordinating major issues and important work related to data security; The cyberspace administration department coordinates the management of network data security; The big data development department is coordinating the construction of the digital Chongqing security protection system; Public security organs and national security organs shall crack down on illegal and criminal activities in accordance with the law; The industry regulatory authorities are responsible for the daily supervision of their respective industries and fields.

In addition, the Regulation also establishes a data security responsibility system of "who manages the business, who manages the business data, and who manages the data security", which precisely compacts the data security responsibility to specific business lines and entities.

In terms of mutual recognition inspection, the Regulation clearly stipulates that relevant departments should reasonably determine the frequency and methods of data security supervision and inspection, and shall not conduct duplicate or multiple inspections. At the same time, for the overlapping parts of data security risk assessment, critical information infrastructure security protection assessment, network security level protection assessment, and commercial password application security assessment, the relevant results can be mutually accepted without the need for repeated assessment.

In terms of classification and grading, the Regulation divides data into three levels: core data, important data, and general data, corresponding to protection levels.

The Regulation stipulates that important data shall be subject to directory management, dynamically updated and regularly inventoried. The basic information of the data, responsible parties, processing methods, security risk assessment results, etc. shall be indicated, but the data content itself shall not be included.

General data is circulated in accordance with the law, important data is controlled for export, and core data is strictly controlled for flow, "said Zhou Jin, the head of the relevant department of the city's data security coordination mechanism. Important data is the top priority of local management. The Regulations stipulate that important data shall be subject to directory management, dynamically updated and regularly inventoried. The basic information of the data, responsible parties, processing methods, security risk assessment results, etc. shall be indicated, but the data content itself shall not be included. "This is like building a ledger for a bank safe: the location, who is keeping it, and the level of protection are all clearly registered, but the contents of the safe will not be leaked

In terms of closed-loop protection, the Regulation has refined the full lifecycle protection process based on the Data Security Law, and established a closed-loop security protection system for data processing entities.

The Regulations specify that data processors must establish and improve the whole process data security management system, and keep data operation records in the form of logs: general logs shall be kept for no less than 6 months, Internet government application logs shall be kept for no less than 1 year, logs involving the traceability of important data security incident disposal shall be kept for no less than 1 year, and relevant logs involving the provision, entrusted processing, and joint processing of important data and personal information to others shall be kept for no less than 3 years.

The regulations on log retention details directly point to the key issues, "said Tan Li, the head of the relevant department of the Municipal Party Committee's Cyberspace Administration. In the past, many companies used to evade accountability for data breaches by claiming that their logs were covered by new data and could not be traced. Now, the" Regulations "have set mandatory retention periods for different situations, providing a complete basis for investigating and tracing security incidents, and legally preventing the destruction of logs to evade accountability.

The Regulation also stipulates that state organs and people's organizations must choose cloud platforms that have passed the national cloud computing service security assessment when purchasing cloud computing services; After the expiration of the service contract, cloud service providers must handle all data stored by users on the cloud platform according to the agreement, and cannot retain it privately, let alone use technical means to recover deleted data.