Understanding China’s
New Data Regime
What Multi-Level Protection Scheme 2.0 Means for Fund Managers
March 2020
China’s latest data protection and cybersecurity reforms — in the form of Multi-Level Protection Scheme 2.0 (MLPS 2.0) — place fresh governance and operational demands on fund managers and introduces new considerations for their technology strategies.
China is a strategic growth priority for many global and regional fund managers, with its fund market on the way to becoming the second largest in the world. The opportunities are significant, but there are many regulatory changes to navigate too. For instance, MLPS 2.0 introduces new requirements relating to personal information, which include:
- New rules determining the way that personal information should be collected and stored
- Tighter controls to prevent unauthorized access and use of personal data
- Expansion of the information systems to which cyber security and data protection controls must be applied, which now includes cloud, mobile and connected devices
The new scheme also creates two different tiers of data protection requirements that companies may fall into. Companies will be assessed based on the level of risk they would pose to China’s national security if there was damage to the network. Key priorities and considerations for fund managers as they respond to MLPS 2.0 requirements and seek to demonstrate their credentials in cyber security are:
- Creating an inventory of all local China data sets
- Assessing technology strategy through a global and local lens
- Evaluating third-party networks
- Ensuring a collaborative response
- Planning for the tech model of tomorrow
