Regulations on the Administration of Commercial Encryption of the PRC — Full English Translation (1999)

Adopted at the 15th Executive Meeting of the State Council on October 7, 1999

Effective: October 7, 1999

Table of Contents

Chapter I — General Provisions

Article 1 — These Regulations are formulated for the purposes of strengthening the administration of commercial encryption, protecting the security of information and networks, safeguarding the lawful rights and interests of citizens and organizations, and maintaining national security and public interests.

Article 2 — For the purposes of these Regulations, “commercial encryption” means encryption technologies and encryption products used to protect information that does not involve state secrets. Commercial encryption technologies are the core technologies of commercial encryption products.

Article 3 — The State Cryptography Administration shall be responsible for the administration of commercial encryption nationwide. The cryptography administration departments of provinces, autonomous regions, and municipalities directly under the Central Government shall be responsible for the administration of commercial encryption within their respective administrative regions.

Article 4 — The State shall adopt a licensing system for the research, production, sale, and use of commercial encryption products, as well as for the import and export of commercial encryption.

Chapter II — Research and Production of Commercial Encryption

Article 5 — Any entity that intends to engage in the research of commercial encryption shall submit an application to the cryptography administration department for approval. An entity approved to engage in the research of commercial encryption shall not transfer the research results without approval.

Article 6 — Any entity that intends to engage in the production of commercial encryption products shall meet the following conditions:

(1) Having a fixed production site and necessary production equipment that meet the requirements;

(2) Having professional technical personnel engaged in the production of commercial encryption products;

(3) Having a sound management system for commercial encryption products;

(4) Other conditions prescribed by the State Cryptography Administration.

Article 7 — An entity engaged in the production of commercial encryption products shall apply to the cryptography administration department for a Designated Production Entity Certificate for Commercial Encryption Products. Upon examination and approval, the certificate shall be issued.

Article 8 — The technical standards for commercial encryption products shall comply with the provisions of the State Cryptography Administration. Commercial encryption products shall pass the testing conducted by testing institutions recognized by the State Cryptography Administration.

Chapter III — Sale and Use of Commercial Encryption

Article 9 — Any entity that intends to engage in the sale of commercial encryption products shall meet the following conditions:

(1) Having a fixed business venue and necessary business facilities;

(2) Having professional technical personnel engaged in the sale of commercial encryption products;

(3) Having a sound management system for sales and after-sales service;

(4) Other conditions prescribed by the State Cryptography Administration.

Article 10 — Commercial encryption products sold shall be produced by entities that have obtained the Designated Production Entity Certificate for Commercial Encryption Products and shall be affixed with the commercial encryption product certification mark.

Article 11 — Entities and individuals using commercial encryption products shall purchase such products from entities that have obtained the sales license for commercial encryption products, and shall not use commercial encryption products produced by entities that have not been designated for production.

Article 12 — Foreign-invested enterprises, foreign enterprises, and other foreign organizations that intend to use encryption products within the territory of China shall report to the State Cryptography Administration for approval. Where the products use foreign-produced encryption products, the relevant import formalities shall be completed.

Article 13 — No entity or individual may use commercial encryption products in a manner that endangers national security or public interests, or damages the lawful rights and interests of other citizens and organizations.

Chapter IV — Import and Export of Commercial Encryption

Article 14 — The import of commercial encryption shall meet the following conditions:

(1) The importer has a legal and valid identity and purpose;

(2) The commercial encryption to be imported has passed the security review of the State Cryptography Administration;

(3) The use of the imported commercial encryption will not endanger national security or public interests.

Article 15 — The export of commercial encryption products shall be subject to approval by the State Cryptography Administration. The export of commercial encryption products that are deemed to pose a potential threat to national security shall be prohibited.

Article 16 — Import and export entities shall not use the import and export of commercial encryption products to engage in activities that endanger national security and public interests.

Chapter V — Supervision and Legal Liability

Article 17 — The cryptography administration departments shall strengthen supervision and inspection of the research, production, sale, and use of commercial encryption products, and the import and export of commercial encryption, and promptly investigate and punish illegal acts in accordance with the law.

Article 18 — Where any entity or individual, in violation of the provisions of these Regulations, engages in the research, production, sale, or use of commercial encryption products without approval, or imports or exports commercial encryption products without approval, the cryptography administration department shall order cessation of the illegal activities and impose penalties in accordance with the law.

Article 19 — Where any entity or individual, in violation of the provisions of these Regulations, uses commercial encryption products in a manner that endangers national security or public interests, the cryptography administration department shall order cessation of use and impose penalties in accordance with the law. Where the case constitutes a crime, criminal liability shall be pursued in accordance with the law.

Chapter VI — Supplementary Provisions

Article 20 — These Regulations shall not apply to encryption technologies and encryption products used to protect state secrets.

Article 21 — The State Cryptography Administration may, in accordance with these Regulations, formulate detailed implementation rules.

Article 22 — These Regulations shall take effect on October 7, 1999.