Data Security Law of the People's Republic of China 09/08/2022, 06:44 classified data protection system, prepare specific catalogs of important data for their respective regions, departments, and relevant industries and sectors, and give priority to the data listed in the catalogs in terms of data protection. Article 22 The state shall establish a centralized, unified, highly effective, and authoritative mechanism for assessing, reporting, information sharing, monitoring, and early alert of data security risks. The coordinating mechanism for national data security shall make an overall plan on and coordinate relevant departments in strengthening the work about acquiring, analyzing, researching and evaluating information of data security risks and the work about early alert of such risks. Article 23 The state shall establish a data security emergency response mechanism. Where a data security incident occurs, the relevant competent departments shall initiate emergency response in accordance with the plan and the law, take corresponding measures to prevent further harm and eliminate security hazards, and send out warnings to the public by publishing information relevant thereto in a timely manner. Article 24 The state shall establish a review system for data security, conducting national security reviews of data processing that affects or may affect national security. Security review decisions made in accordance with the law are final decisions. Article 25 The state shall apply export control in accordance with the law on data that are controlled items and concern national security and interests and the performance of international obligations. Article 26 Where any country or region adopts discriminatory prohibitions, restrictions, or other similar measures against the People’s Republic of China in respect of investment, trade or any other field related to data and data development and utilization technologies, the People’s Republic of China may take countermeasures against that country or region in light of the actual circumstances. Chapter IV Data Security Protection Obligations Article 27 In data processing, the laws and regulations shall be complied http://www.npc.gov.cn/englishnpc/c23934/202112/1abd8829788946ecab270e469b13c39c.shtml Page 6 of 13