China’s National Cybersecurity Policy: Institutional Pressures

The article studies the driving factors behind the formation of China’s national cybersecurity policy through the application of the institutional theory. The institutionalization of China’s cyber governance is explored by evaluating the impact of coercive, mimetic and normative pressures, originally suggested by DiMaggio and Powell in the organizational theory. The article provides an overview of China’s reforms in the Internet field, the domestic institutional framework regulating cyberspace in China, and a review of the documents passed since 2014. The factor of US threat is evaluated as a coercive force, which boosted proactive reforms of China’s national cybersecurity policy. New initiatives in cyber governance realm proposed by Western states push Chinese officials to encourage local response, often mirroring the actions of other states and adapting them to national needs. Thus, the Cybersecurity Law of 2017 and the Personal Information Protection Laws of 2021 are compared to the General Data Protection Regulation adopted in the EU. The introduction of domestic legal and normative reforms and promotion of the “cyber sovereignty” doctrine by the Chinese government is studied along with the existing regulations and norms in the cyber governance and contrasted with the position of the Western states. In China, the government is the major driving force behind the formation of national cybersecurity policy reforms and since 2014 the agenda in the regulation of Internet space has been clearly defined both domestically and internationally. China’s intention to extend its position in global governance is based on the belief that it should shift from being a “rule taker” to a “rule creator”. However, China still has a long way to go to align the actual readiness of private enterprises and the society with the policy goals.