On March 15, 2024, SAC released the "GB/T 43697-2024 Data security technology — Rules for data classification and grading."

China's "Data Security Law" stipulates the establishment of a data classification and grading protection system by the state, proposing to "implement classified protection for data based on the importance of data in economic and social development, as well as the degree of harm to national security, public interests, or the legitimate rights and interests of individuals and organizations once data is altered, damaged, leaked, illegally obtained, or illegally used." The "Personal Information Protection Law" also proposes the requirement of "classified management of personal information." To carry out data classification and grading protection work, it is necessary to classify and grade data first, identify key data and core data involved, and then establish corresponding data security protection measures.

This standard will provide support for identifying various types of data involved in laws and regulations such as the "Data Security Law" and the "Personal Information Protection Law." It specifies the principles, framework, methods, and processes of data classification and grading, and provides guidelines for identifying key data. The standard is applicable for industry sector regulators to formulate standards and norms for data classification and grading in their respective industries and fields, and also applicable for regions and departments to carry out data classification and grading work, providing references for data processors to classify and grade data.

This standard will be used in conjunction with national standards such as "GB/T 35273-2020 Information security technology—Personal information security specification" to constitute the implementation basis of China's data security management system.