Promulgated by: General Office of the Jiangxi Provincial People’s Government.
Document No.: 赣府厅发〔2025〕26号 (Gan Fu Ting Fa [2025] No. 26).
Issued November 11, 2025. Effective December 15, 2025 (valid for two years).

Translation note — DCC. Translated in full from the official Chinese text of the issuing notice and the Measures. Terminology follows DCC’s bilingual glossary and the usage in the national Implementing Specifications for the Authorized Operation of Public Data Resources (Trial). “Three majors and one large” (三重一大) is the collective decision-making mechanism for major decisions, major appointments, major projects and large expenditures.

Notice on Issuing the Jiangxi Province Measures for the Administration of Authorized Operation of Public Data Resources (Trial)

To the people’s governments of all cities and counties (districts) and all departments of the Provincial Government:

With the consent of the Provincial Government, the Jiangxi Province Measures for the Administration of Authorized Operation of Public Data Resources (Trial) are hereby issued to you. Please implement them conscientiously in light of actual conditions.

November 11, 2025

Jiangxi Province Measures for the Administration of Authorized Operation of Public Data Resources (Trial)

Chapter I General Provisions

Article 1. These Measures are formulated in accordance with the Cybersecurity Law of the People’s Republic of China, the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Regulations on Government Data Sharing, the Jiangxi Province Data Application Regulations and other laws and regulations, and in accordance with the relevant requirements of the Opinions of the General Office of the CPC Central Committee and the General Office of the State Council on Accelerating the Development and Utilization of Public Data Resources and the Notice of the National Development and Reform Commission and the National Data Administration on Issuing the Implementing Specifications for the Authorized Operation of Public Data Resources (Trial), and in light of the actual conditions of this Province, in order to regulate the authorized operation of public data resources and promote the orderly development and utilization of public data resources.

Article 2. These Measures apply to the authorized operation of public data resources and related administrative activities carried out within the administrative area of this Province.

Article 3. “Authorized operation” means the activity whereby a people’s government at or above the county level determines an implementing institution and authorizes, in accordance with laws, regulations and relevant requirements, qualified operating institutions to govern and develop the public data resources held by people’s governments at or above the county level and by industry competent departments, and to provide public data products and services to the market on a fair basis.

“Implementing institution” means the unit determined by a people’s government at or above the county level that is specifically responsible for organizing and carrying out authorized-operation activities. At the provincial level the Provincial Big Data Center is the implementing institution. Cities and counties shall determine their own in light of actual conditions.

“Operating institution” means a legal-person organization determined in accordance with standard procedures to develop and operate the public data resources within the scope of authorization.

“Public data products and services” means datasets, data models, data reports, solutions and data products and services in other forms formed by an operating institution through the processing of public data resources.

Article 4. The provincial data authority shall, together with the provincial government-services, state security, cyberspace, secrecy administration, cryptography administration, public security, finance and other relevant provincial departments, advance as a whole the authorized operation of public data resources across the Province, strengthen business guidance and supervision and administration, coordinate the resolution of major issues, strengthen the management of public data assets, and carry out the security supervision of authorized operation in accordance with its duties.

The people’s governments of cities divided into districts and of counties shall be responsible for the overall coordination and supervision and administration of the authorized operation of public data resources within their administrative areas.

Industry competent departments shall, in accordance with their respective duties, be responsible for the aggregation and quality management of the public data resources of their industries and fields, promote authorized operation, and guide their industries in strengthening the management of industry data resources within the scope of authorized operation.

Chapter II Data Supply

Article 5. Government departments at all levels at or above the county level shall bring the public data resources they hold lawfully and compliantly into authorized operation, on the premise of implementing the requirements of the classified and graded data protection system, not endangering national security or the public interest, and not infringing trade secrets, personal privacy, personal information rights and interests or other lawful rights and interests. For public data resources not brought into authorized operation, government departments at all levels at or above the county level shall state the policy basis and report it to the data authority at the same level; the data authority shall, together with the relevant departments, review it and form a negative list for submission to the people’s government at the same level for approval.

Where public data of another region or department obtained by way of government data sharing is used for authorized operation, the consent of the unit providing the shared data shall be obtained. Government data shall be shared uniformly through the Jiangxi Province integrated government big-data platform.

Article 6. Industry competent departments shall, under the guidance of the data authority at the same level and in accordance with the requirement of “one datum, one source, one standard,” strengthen source data governance and quality control and carry out data aggregation.

Data authorities shall establish mechanisms for data-quality monitoring and evaluation, correction of problematic data, and verification and handling of objections, so as to improve the quality of public data supply.

Chapter III Authorization Process

Article 7. The authorized operation of public data resources may adopt models such as whole authorization, authorization by field and authorization by scenario. At the provincial level the whole-authorization model shall be the main model, and authorization by field or by scenario may be adopted for key fields and key scenarios. Cities and counties shall determine their own models in light of actual conditions.

Article 8. The data authority shall, together with the government-services and relevant industry competent departments, organize the preparation of, or guide the implementing institution in preparing, an implementation plan for the authorized operation of public data resources (hereinafter the “implementation plan”); the content of the implementation plan shall be prepared in accordance with the requirements of the national documents.

Article 9. The implementation plan shall be submitted by the data authority to the people’s government at the same level for deliberation under the “three majors and one large” decision-making mechanism. An implementation plan approved at the city or county level shall be filed with the provincial data authority in accordance with procedures within 20 working days.

In principle, an approved implementation plan shall not be changed at will; where a major change is genuinely necessary, it shall be re-submitted for examination and approval in accordance with the original process.

Article 10. The implementing institution shall, in accordance with the approved implementation plan, select operating institutions by fair-competition methods such as public tender, invited tender or negotiation.

An operating institution shall possess the management and technical service capabilities required for the processing and operation of data resources, be in good business and credit standing, and meet the State’s data security protection requirements.

Article 11. The implementing institution shall, independently or together with the relevant business competent departments at the same level, and after deliberation and approval under the implementing institution’s “three majors and one large” decision-making mechanism, sign an agreement on the authorized operation of public data resources (hereinafter the “operating agreement”) with the operating institution selected in accordance with law; the content of the operating agreement shall be drawn up in accordance with the requirements of the national documents. A signed operating agreement shall be filed with the provincial data authority in accordance with procedures within 20 working days.

Chapter IV Implementation of Operations

Article 12. The provincial data authority shall, in accordance with the requirement that “raw data does not leave the domain and data is usable but not visible,” and relying on this Province’s data infrastructure, explore the intensive construction of a province-wide unified platform for the authorized operation of public data resources (hereinafter the “provincial platform”), providing authorized-operation activities with a secure and controllable development and utilization environment with functions including data aggregation, development and utilization, security supervision and whole-process auditing. In principle, cities divided into districts shall no longer build independent authorized-operation platforms; where genuinely necessary, the local data authority shall report to the provincial data authority for consent, and the platform shall be built in accordance with “unified catalogue identifiers, unified identity registration and unified interface requirements” and interfaced with the provincial platform.

Article 13. The implementing institution and the operating institution shall respectively register the public data resources and the public data products and services within the scope of authorized operation on the Jiangxi Province public data resource registration platform. The prices of public data products and services shall be governed by the relevant national pricing policies.

Article 14. Authorized operation shall protect the lawful rights and interests of all participants; income formed from the use of the data resources of administrative and public institutions shall be managed in accordance with the relevant provisions on government non-tax revenue and the centralized treasury collection system.

Pathways for the proceeds of the authorized operation of public data resources to feed back into the building of public services shall be explored, supporting the data governance and service capacity-building of all regions and departments.

Article 15. An operating institution shall not by any means provide or sub-authorize to a third party the public data resources under authorized operation; shall not leak, steal or tamper with public data resources; shall not use public data resources beyond the scope of authorization; and shall not directly or indirectly participate in the re-development of public data products and services already delivered within the scope of authorization. Other business entities are encouraged to re-develop the public data products and services delivered by operating institutions.

Where, in the course of developing data resources, the multi-source aggregation, association and integration of data gives rise to circumstances that may endanger national security, affect social stability, harm the public interest, or leak personal privacy, personal information or trade secrets, the operating institution shall terminate development as stipulated in the operating agreement and report back to the implementing institution.

Article 16. Where, during the term of authorized operation, an operating institution fails to comply with the authorized-operation agreement or a major operating risk arises, the implementing institution shall suspend performance or terminate the authorized operation early as stipulated in the operating agreement.

Where an agreement on the authorized operation of public data resources is terminated, the implementing institution shall promptly terminate the operating institution’s access privileges to the platform for the authorized operation of public data resources, report to the data authority at the same level, and retain the operating institution’s complete work logs for not less than three years. A withdrawing operating institution shall cooperate with the implementing institution in the handover.

Chapter V Security Safeguards

Article 17. The implementing institution shall establish and improve a security and compliance management mechanism for the authorized operation of public data resources, implement the classified and graded data protection and confidentiality requirements, and formulate security-protection rules and norms for security and compliance review, risk assessment, monitoring and early warning, and emergency response. It shall strengthen the assessment of application scenarios and data needs, strictly control the direct entry into the market of raw public data resources that have not been made public in accordance with laws and regulations, and strengthen internal-control audits of operating institutions in respect of the authorized operation of public data resources.

Operating institutions shall perform their primary responsibility for data security, strengthen internal-control, technical and personnel management, and strictly guard against data security risks arising in data processing, handling, operation, service and other links.

Article 18. Data authorities shall, jointly with the cyberspace, public security and other departments and together with the relevant industry departments, establish a rapid joint-response mechanism, study and formulate data security emergency action plans, and, once a security incident occurs, respond swiftly in accordance with the action plan.

The implementing institution shall organize operating institutions to formulate data security incident emergency plans and to conduct emergency drills and network data security risk assessments periodically. When a data security incident occurs, the operating institution shall activate emergency response in accordance with the emergency plan and report promptly to the data authority in accordance with procedures.

Chapter VI Supervision and Administration

Article 19. Data authorities shall, together with the government-services, state security, cyberspace, secrecy administration, cryptography administration, public security, finance and other departments, evaluate the data contributions of industry competent departments at the same level and make good use of the results, so as to promote the release of the value of public data resources.

The implementing institution shall, in accordance with regulations, make public the authorized parties, content, scope, time limits and other particulars of authorized operation, and shall evaluate the performance of authorized-operation agreements, the quality of data products and services, data security safeguards and user satisfaction.

Operating institutions shall publish their lists of public data products and services, disclose the use of public data resources, and accept public supervision.

Article 20. Operating institutions shall strengthen the internal management of costs, revenues and expenditures relating to public data products and services, manage the financial receipts and payments relating to public data products and services in accordance with the existing financial management system, and accept supervision in accordance with law.

Article 21. Entities involved in the authorized operation of public data resources are encouraged and supported in actively exploring innovative measures conducive to the development and utilization of public data resources; officials are encouraged and protected in taking responsibility and acting, and an atmosphere of undertaking and entrepreneurship that encourages and tolerates innovation is to be fostered. Where mistakes or deviations occur in the course of exploration but there has been no abuse of power, dereliction of duty or use of office for private gain leading to loss, the liability of the responsible entities shall be exempted or mitigated in accordance with procedures after a due-diligence exemption assessment conducted in accordance with the relevant national and provincial provisions.

Article 22. Authorized-operation activities shall effectively identify and control the potential risks of the conversion of data into assets, the capitalization of data assets and securitization, and effectively prevent and defuse financial risks.

Chapter VII Supplementary Provisions

Article 23. Public data resources held by public utilities such as water supply, gas supply, heat supply, electricity supply and public transport may be authorized for use by reference to the relevant procedures of these Measures.

Article 24. The Provincial Development and Reform Commission (Provincial Data Bureau) shall be responsible for the interpretation of these Measures.

Article 25. These Measures shall come into force on December 15, 2025 and shall be valid for two years.