If you plan to run an online store, marketplace, or app in China, two compliance frameworks apply from day one: the Cybersecurity Law of the PRC and the Multi-Level Protection Scheme (MLPS), known locally as dengbao. Most e-commerce systems fall into MLPS Level 2 or Level 3, filing must occur within 30 days of level confirmation, and penalties for non-compliance now reach RMB 500,000 for ordinary operators — and up to RMB 10 million for critical information infrastructure.
Quick Facts
| Metric | Value |
|---|---|
| Cybersecurity Law effective date | June 1, 2017 (amended October 28, 2025) |
| MLPS filing deadline | Within 30 days of level confirmation (Level 2 and above) |
| Filing fee | RMB 0 (free of charge, fully online) |
| Network log retention | Minimum 6 months |
| Typical e-commerce MLPS level | Level 2 (standard stores/apps); Level 3 (large platforms, payment systems) — estimated |
| Level 2 filing materials | 10 items |
| Level 3 filing materials | 13 items (10 + 3 additional) |
| Penalty for failing security obligations | RMB 10,000–50,000; up to RMB 500,000 if harm results |
| Penalty for failing real-name verification | RMB 50,000–500,000 |
| Assessment cycle | Level 2: every 2 years; Level 3: annually |
| Remediation and assessment cost | No unified official standard (estimated: Level 2 tens of thousands to hundreds of thousands RMB; Level 3 hundreds of thousands to ~RMB 1 million) |
What Is China's Cybersecurity Law and Who Does It Apply To?
The Cybersecurity Law of the PRC took effect on June 1, 2017 and was amended on October 28, 2025. It establishes the national cybersecurity multi-level protection system and imposes five core security obligations on all network operators, including foreign-invested e-commerce businesses.
Under Article 23 of the amended law, network operators must implement security systems and technical measures, monitor and record network activity with logs retained for at least 6 months, back up and encrypt data, and comply with other statutory duties Cybersecurity Law of the PRC (2025 Amendment), Article 23. Article 24 requires that network products and services meet mandatory national security standards and that operators promptly remediate and report discovered vulnerabilities Cybersecurity Law of the PRC (2025 Amendment), Article 24.
Article 26 requires real-name verification for users accessing network services, registering domains, publishing information, or using instant messaging — a direct obligation for any e-commerce platform with user accounts Cybersecurity Law of the PRC (2025 Amendment), Article 26. Article 27 mandates emergency response plans and immediate remediation and reporting when incidents occur Cybersecurity Law of the PRC (2025 Amendment), Article 27.
The law applies to network operators broadly — anyone who owns, manages, or provides services over networks. If your business operates a website, app, mini-program, or cloud-hosted store serving users in China, you are a network operator under this law.
What Is MLPS (Dengbao) and Why Does It Matter for E-Commerce?
MLPS is China's tiered cybersecurity protection scheme. It classifies information systems into five levels based on the potential harm if the system is damaged, and requires operators to file with public security authorities, implement corresponding safeguards, and undergo periodic assessments.
The five levels range from Level 1 (self-protection, minimal harm) to Level 5 (state-controlled protection, severe national security impact) MLPS 2.0 Framework. Level 2 applies where damage would seriously harm the lawful rights of citizens or legal persons or harm social order and public interest, without endangering national security MLPS Level Definitions.
For e-commerce, the typical pattern is: standard online stores and apps generally fall into Level 2, while large platforms, payment systems, and systems handling massive transaction volumes may be assessed at Level 3 (estimated — final level is determined through the grading matrix and confirmed by public security authorities, not self-declared by the enterprise) MLPS Grading Guidance.
MLPS matters commercially because it is a prerequisite for many downstream steps: ICP licensing reviews, cloud provider onboarding, and partner due diligence frequently ask for your dengbao filing certificate. Without it, your platform may face operational friction even before any penalty is considered.
How Does the MLPS Filing Process Work Step by Step?
The MLPS process follows five stages: grading, filing, construction and remediation, level assessment, and ongoing supervision MLPS Five-Stage Process. Here is the practical sequence:
- Determine your system's level. Using the official grading matrix, assess the potential harm if your system is compromised. Most e-commerce systems land at Level 2; larger platforms may warrant Level 3 (estimated) MLPS Grading Matrix.
- Engage a qualified assessment institution. A licensed testing agency conducts an initial evaluation to validate your proposed level and identify gaps.
- File with public security within 30 days of level confirmation. For Level 2 and above, submit the filing package to the local public security bureau's cybersecurity division within 30 days of confirming the level — note this is 30 days from level confirmation, not from system launch [Measures for Security Protection of Information Systems (Gong Tong Zi [2007] No. 43), Article 15](http://banshi.beijing.gov.cn/pubtask/task/1/110108000000/46786d45-a5b7-468e-8f81-3960bf348fa8.html).
- Complete construction and remediation. Implement the technical and administrative controls required for your level, then undergo a formal level assessment by a licensed institution.
- Maintain ongoing compliance. Retain logs for at least 6 months, conduct periodic re-assessments (Level 2 every 2 years, Level 3 annually), and cooperate with public security supervision checks, which are conducted free of charge Cybersecurity Law of the PRC (2025 Amendment), Article 23; Network Data Security Management Regulations.
The filing itself is free of charge and can be completed entirely online through the Beijing public security portal Beijing Public Security Bureau MLPS Filing Guide.
What Documents Do You Need for MLPS Filing?
The filing package differs by level. Level 2 requires 10 items; Level 3 adds 3 more, for a total of 13 Beijing Public Security Bureau MLPS Filing Guide.
| Document | Level 2 | Level 3 |
|---|---|---|
| Filing form | Required | Required |
| Grading report | Required | Required |
| Commitment letter | Required | Required |
| Expert review opinion | Required | Required |
| Business license | Required | Required |
| Legal representative ID | Required | Required |
| Power of attorney | Required | Required |
| Office address proof | Required | Required |
| Server hosting agreement | Required | Required |
| Emergency contact registration form | Required | Required |
| System topology diagram | — | Required |
| Network security product list and test reports | — | Required |
| Information security work management system | — | Required |
Our advisory team can outline which documents apply to your specific system architecture and coordinate with qualified local professionals to prepare the package.
What Are the Penalties for Non-Compliance?
Penalties under the 2025 amendment are materially higher than the original 2017 version. Failing to fulfill security protection obligations now carries a fine of RMB 10,000–50,000, rising to RMB 50,000–500,000 if the operator refuses to correct or a harmful consequence results Cybersecurity Law of the PRC (2025 Amendment), Article 61. The original 2017 version imposed only RMB 10,000–100,000 for the same conduct Cybersecurity Law of the PRC (2016 Original), Article 59.
| Violation | Fine Range (2025 Amendment) | Responsible Person |
|---|---|---|
| Failing security protection obligations | RMB 10,000–50,000; up to RMB 50,000–500,000 if harm results | RMB 10,000–100,000 |
| Failing real-name verification | RMB 50,000–500,000; possible business suspension or site closure | RMB 10,000–100,000 |
| Product/service security violations | RMB 50,000–500,000 | RMB 10,000–100,000 |
| CII operator failing obligations | RMB 50,000–100,000; up to RMB 100,000–1,000,000 if harm results | RMB 10,000–100,000 |
For critical information infrastructure (CII) operators, the stakes escalate sharply: fines range from RMB 50,000–100,000 for basic failures, up to RMB 200,000–1,000,000 where large-scale data leakage or loss of main CII functions occurs Cybersecurity Law of the PRC (2025 Amendment), Article 61. However, CII designation is determined by sector regulators, and ordinary e-commerce platforms are unlikely to be designated as CII unless they operate large-scale payment or public-service systems Cybersecurity Law of the PRC (2016 Original), Articles 31–40.
What Are the Ongoing Obligations After Filing?
Filing is not a one-time event. The law imposes continuous duties that require operational discipline.
Log retention. You must retain network logs for at least 6 months — this covers access logs, transaction logs, and administrative operation logs for e-commerce systems Cybersecurity Law of the PRC (2025 Amendment), Article 23. Note this is distinct from the 3-year transaction information retention requirement under the E-Commerce Law; the two obligations coexist.
Real-name verification. Every user account, domain registration, and information publication function must verify real identity Cybersecurity Law of the PRC (2025 Amendment), Article 26.
Incident response. You must maintain emergency response plans and immediately remediate and report incidents when they occur Cybersecurity Law of the PRC (2025 Amendment), Article 27. Under the national incident reporting framework, a major incident includes portal sites inaccessible for over 6 hours, critical infrastructure outage exceeding 1 hour, impact on over 1 million people, leakage of personal information of over 10 million people, or direct economic losses over RMB 20 million National Cybersecurity Incident Reporting Measures (2025).
Periodic assessment. Level 2 systems are re-assessed every 2 years; Level 3 annually. Missing an assessment cycle does not carry a specific fine, but public security authorities will flag it during supervision checks MLPS Five-Stage Process.
Data security law linkage. The Data Security Law requires operators to fulfill data protection obligations on the basis of the MLPS framework Data Security Law of the PRC, Article 27. In practice, your dengbao certification underpins your broader data compliance posture.
How Much Does MLPS Compliance Cost?
There is no unified official fee schedule for remediation and assessment work. The filing itself is free — public security authorities charge nothing, and the entire process can be completed online Beijing Public Security Bureau MLPS Filing Guide. Supervision checks are likewise conducted free of charge Network Data Security Management Regulations.
The real costs are commercial: engaging a licensed assessment institution, implementing required technical controls, and periodic re-assessments. Based on market estimates, Level 2 remediation and assessment typically runs from tens of thousands to several hundred thousand RMB depending on system scale, while Level 3 can reach several hundred thousand to around RMB 1 million (estimated — no official standard exists) MLPS Cost Considerations.
Budget planning should treat these as recurring, not one-time: assessment fees recur on the cycle for your level, and any system upgrade or architecture change may trigger re-evaluation.
What to Watch Out For
Version confusion. The 2025 amendment renumbered articles: original Article 21 became Article 23, original Article 25 became Article 27, and original Article 59 became Article 61 with substantially higher fine ranges Cybersecurity Law of the PRC (2025 Amendment), Article 29 note. Always cite the amended version; mixing old and new article numbers or fine ranges is a common error.
MLPS 2.0 vs 1.0. Since December 1, 2019, MLPS 2.0 standards apply, extending coverage to cloud computing, mobile internet, IoT, industrial control, and big data. Do not reference the superseded MLPS 1.0 standards MLPS 2.0 Framework.
Level is confirmed, not self-declared. The enterprise proposes a level, but public security authorities review and confirm it. Presenting a self-assigned level as final is a filing defect MLPS Grading Guidance.
30-day clock starts at confirmation. The 30-day filing window begins when the level is confirmed, not when the system goes live. Missing this window is a compliance gap even if the system is otherwise secure [Measures for Security Protection of Information Systems (Gong Tong Zi [2007] No. 43), Article 15](http://banshi.beijing.gov.cn/pubtask/task/1/110108000000/46786d45-a5b7-468e-8f81-3960bf348fa8.html).
Log retention is not transaction retention. The 6-month network log requirement is separate from the 3-year transaction record requirement under the E-Commerce Law. Confusing the two leads to under-retention of one or the other Cybersecurity Law of the PRC (2025 Amendment), Article 23.
Assessment costs are borne by the operator. While filing and supervision checks are free, the level assessment itself must be commissioned by the operator from a licensed institution — this is a real budget line Network Data Security Management Regulations.
Frequently Asked Questions
Q: Does every e-commerce business in China need MLPS filing?
A: Any operator of a Level 2 or above system must file within 30 days of level confirmation. Most e-commerce websites and apps are assessed at Level 2, so in practice nearly all online stores with user accounts and transactions need to complete dengbao filing [Measures for Security Protection of Information Systems (Gong Tong Zi [2007] No. 43), Article 15](http://banshi.beijing.gov.cn/pubtask/task/1/110108000000/46786d45-a5b7-468e-8f81-3960bf348fa8.html).
Q: How long does the MLPS filing process take?
A: The statutory deadline is filing within 30 days of level confirmation. The full cycle — grading, remediation, assessment, and filing — typically takes 2 to 4 months for a Level 2 system, depending on how quickly gaps are closed and the assessment institution's schedule (estimated) MLPS Five-Stage Process.
Q: What is the difference between MLPS Level 2 and Level 3 for online stores?
A: Level 2 applies where damage would seriously harm citizens' or legal persons' rights or social order; Level 3 applies where damage would harm national security or cause serious public-interest harm. Level 3 requires 3 additional filing documents and annual re-assessment instead of every 2 years MLPS Level Definitions.
Q: Is there a government fee for MLPS filing?
A: No. The filing is free of charge — public security authorities collect no fee, and the process can be completed entirely online. However, the operator bears the cost of engaging a licensed assessment institution for the level assessment Beijing Public Security Bureau MLPS Filing Guide.
Q: What happens if I miss the 30-day filing deadline?
A: Missing the deadline constitutes failure to fulfill security protection obligations. Under the 2025 amendment, this carries a fine of RMB 10,000–50,000, rising to RMB 50,000–500,000 if the operator refuses to correct or harm results Cybersecurity Law of the PRC (2025 Amendment), Article 61.
Q: Do I need MLPS filing before getting an ICP license?
A: In practice, yes for most commercial platforms. While the ICP licensing rules and MLPS rules are separate legal frameworks, public security filing confirmation is commonly requested during ICP review for platforms with user registration and transaction functions. Plan both in parallel rather than sequentially (advisory observation) MLPS Filing Guide.
Q: How long must I keep network logs under the Cybersecurity Law?
A: At least 6 months. This covers access logs, transaction logs, and administrative operation logs. Note this is separate from the 3-year transaction information retention requirement under the E-Commerce Law — both apply simultaneously to e-commerce systems Cybersecurity Law of the PRC (2025 Amendment), Article 23.
Q: Can a foreign-owned company complete MLPS filing, or does it need a Chinese entity?
A: MLPS filing is done by the system operator, which must be a legally registered entity in China. A Wholly Foreign-Owned Enterprise (WFOE) or joint venture can file directly as the operator. You cannot file as an offshore entity — the filing requires a Chinese business license and legal representative ID Beijing Public Security Bureau MLPS Filing Guide.
Q: What is the difference between the Cybersecurity Law and the Data Security Law for e-commerce?
A: The Cybersecurity Law establishes the MLPS framework and network operator obligations; the Data Security Law requires data protection measures built on top of that MLPS foundation. Article 27 of the Data Security Law explicitly links data protection duties to the MLPS system Data Security Law of the PRC, Article 27.
Q: How often do I need to re-assess my MLPS level?
A: Level 2 systems are re-assessed every 2 years; Level 3 systems annually. Missing a cycle does not carry a specific fine, but public security authorities will identify it during supervision checks and require correction MLPS Five-Stage Process.
Conclusion
Three takeaways for foreign e-commerce operators entering China:
- MLPS filing is a structural prerequisite, not an optional extra. Nearly all e-commerce systems with user accounts and transactions are assessed at Level 2 or above and must file within 30 days of level confirmation — the filing is free and fully online, but the assessment and remediation work is a real budget item.
- The 2025 amendment raised the stakes. Fine ranges for security obligation failures now start at RMB 10,000 and reach RMB 500,000 for ordinary operators, with CII operators facing up to RMB 1,000,000. Article numbers and penalty ranges changed — always work from the amended text.
- Ongoing obligations are operational, not just paperwork. Six-month log retention, real-name verification, incident response plans, and periodic re-assessment require process discipline long after the certificate is issued.
For personalized guidance on your China e-commerce licensing pathway, contact the CnBusinessHub advisory team at consult@CnBusinessHub.com to book a consultation.
Written by the CnBusinessHub Advisory Team, China market-entry advisors since 2019 — 1,500+ foreign enterprises guided across 16+ cities.
Last updated: 2026-10-11 | Next review: April 2027
Sources
- Cybersecurity Law of the PRC (2025 Amendment) — Cyberspace Administration of China
- Cybersecurity Law of the PRC (2016 Original) — Cyberspace Administration of China
- Beijing Public Security Bureau — MLPS Filing Guide
- [Beijing Haidian District Public Security Bureau — MLPS Filing (Gong Tong Zi [2007] No. 43)](http://banshi.beijing.gov.cn/pubtask/task/1/110108000000/46786d45-a5b7-468e-8f81-3960bf348fa8.html)
- National Cybersecurity Incident Reporting Measures (2025) — Cyberspace Administration of China
- Data Security Law of the PRC — Cyberspace Administration of China
- Network Data Security Management Regulations — Cyberspace Administration of China
Related Reading
- Mini Program Filing and ICP Compliance — A Step-by-Step Guide for Foreign Businesses in 2026
- PIPL and Data Compliance for Social Commerce in China 2026
- China ICP Filing for Foreign Company: Website Compliance Requirement Guide
Disclaimer
This article is written by the CnBusinessHub team for informational and educational purposes only.
The content of this article does not constitute any form of investment advice, business advice, or legal opinion. Readers should exercise their own judgment regarding the applicability of the information and should consult qualified professionals before making any business decisions.
The data and information cited in this article are sourced from public channels. While we strive for accuracy, we do not guarantee the completeness or timeliness of the information. Policies and regulations may change at any time; please verify the latest information before taking action.
© 2026 CnBusinessHub. All rights reserved.
