Promulgated by: General Office of the Shanghai Municipal People’s Government.
Document No.: 沪府办发〔2025〕15号 (Hu Fu Ban Fa [2025] No. 15).
Issued July 12, 2025. Effective July 12, 2025.
Translation note — DCC. Translated in full from the official Chinese text of the issuing notice and the Measures as published by the Shanghai Municipal People’s Government. Terminology follows DCC’s bilingual glossary and the usage in the national Implementing Specifications for the Authorized Operation of Public Data Resources (Trial). The parenthetical article captions are part of the original text.
Notice of the General Office of the Shanghai Municipal People’s Government on Issuing the Shanghai Municipality Measures for the Administration of Authorized Operation of Public Data Resources
To the people’s governments of all districts and all commissions, offices and bureaus of the Municipal Government:
The Shanghai Municipality Measures for the Administration of Authorized Operation of Public Data Resources have been approved by the Municipal Government and are hereby issued to you. Please implement them conscientiously.
General Office of the Shanghai Municipal People’s Government
July 12, 2025
Shanghai Municipality Measures for the Administration of Authorized Operation of Public Data Resources
Chapter I General Provisions
Article 1 (Purpose and basis). These Measures are formulated in accordance with the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Shanghai Municipality Data Regulations and other laws and regulations, and in light of the actual conditions of this Municipality, in order to accelerate the development and utilization of public data resources, regulate the authorized operation of public data resources, cultivate the data element market, develop new quality productive forces and optimize the business environment.
Article 2 (Scope of application). These Measures apply to the authorized operation of public data resources and related administrative activities within the administrative area of this Municipality.
Article 3 (Definitions). For the purposes of these Measures, “authorized operation of public data resources” means the activity of authorizing, in accordance with laws, regulations and relevant requirements, qualified operating institutions to govern and develop this Municipality’s public data resources and to provide data products and services to the market on a fair basis.
“Implementing institution” means the entity determined by the Municipal Government in accordance with standard procedures that is specifically responsible for organizing and carrying out authorized-operation activities.
“Operating institution” means a legal-person organization that has obtained authorization in accordance with standard procedures to develop and operate the public data resources within the scope of the authorization.
“Development entity” means a legal person or unincorporated organization that develops public data resources on a scenario basis to form data products and services that meet market-based demand.
Article 4 (Basic principles). The authorized operation of public data resources shall attach equal importance to development and security and shall follow the principles of “lawfulness and compliance, fairness and impartiality, unified authorization, priority to the public interest, reasonable returns, and security and controllability,” protecting in accordance with law the lawful rights and interests of all participants in authorized operation, safeguarding national security and the public interest, and protecting personal information and trade secrets.
Article 5 (Government responsibilities). The Municipal Government shall strengthen overall leadership of the authorized operation of public data resources across the Municipality and, relying on the Municipal Leading Group for Data Development and Administration, establish and improve working mechanisms and study and resolve major issues in the authorized operation of public data resources.
District governments shall, according to the needs of their distinctive industries, cultivate public data development entities by providing policy support, park carriers and similar means, expand application scenarios, foster a flourishing ecosystem of data businesses, guide the cross-sector integrated application of data, and promote the high-quality development of the digital economy.
Article 6 (Division of departmental responsibilities). The municipal data authority shall be responsible for the comprehensive coordination and administration of the authorized operation of public data resources in this Municipality; shall, in accordance with procedures, request the Municipal Government to determine a single citywide implementing institution; shall formulate the administrative rules and standards for the authorized operation of public data resources; and shall coordinate the sharing and opening of public data and authorized operation.
Each industry competent department shall be responsible for the supply and data-quality management of the public data resources of its own system and industry, participate in the planning and building of data application scenarios, promote innovation in data applications, and cooperate in advancing the authorized operation of public data resources involving its system and industry.
The cyberspace, development and reform, public security, finance, market regulation, state-owned assets, intellectual property and other departments shall, within their respective duties, coordinate and cooperate in the work relating to the authorized operation of public data resources.
Article 7 (Resource registration). Public data resources involved in authorized operation shall be registered. Registration of data products and services formed by processing authorized public data resources (hereinafter “public data products and services”) is encouraged.
The relevant registration work shall be carried out in accordance with the detailed implementing rules of the municipal data authority.
Chapter II Authorization Administration
Article 8 (Authorization model). This Municipality adopts a whole-authorization model for the authorized operation of public data resources.
A district that has a genuine need may, under the overall leadership of the Municipality and upon reporting to and obtaining the consent of the Municipal Leading Group for Data Development and Administration, carry out the authorized operation of public data resources in accordance with these Measures.
Article 9 (Implementation plan). The municipal data authority shall guide the implementing institution in preparing an implementation plan for the authorized operation of public data resources (hereinafter the “implementation plan”), which shall be submitted to the Municipal Government for examination and approval before implementation. The implementation plan shall include the scope of data resources subject to authorized operation, the selection criteria for operating institutions, the term of authorized operation, the exit mechanism, supervision and administration and assessment and evaluation requirements, the mechanism for accounting for the operating institution’s operating costs and revenues within the scope of the authorization, the revenue-distribution mechanism, and security-protection and emergency-response measures.
Article 10 (Selection of operating institutions). The implementing institution shall, in accordance with the approved implementation plan and the prescribed procedures, select operating institutions by way of fair competition, sign an agreement on the authorized operation of public data resources with the operating institution, and file it with the municipal data authority for the record.
An operating institution shall be a legal-person organization that possesses the management and technical service capabilities required for the governance, processing and operation of data resources, has no record of improper business conduct, is in good credit standing, and meets the State’s data security protection requirements.
Article 11 (Prohibited circumstances). Without going through the authorized-operation procedures provided for in these Measures, industry competent departments at all levels of this Municipality and their subordinate public institutions shall not, on their own or by entrusting a third party, develop public data products and services and provide them to society for consideration. Where laws or regulations provide otherwise, those provisions shall prevail.
Chapter III Data Infrastructure
Article 12 (Data infrastructure). This Municipality shall build a unified citywide data infrastructure with the aid of digital technologies such as blockchain, privacy computing and trusted data spaces.
Relying on the citywide data infrastructure, the implementing institution shall establish a public data authorized-operation domain and build a unified infrastructure for the authorized operation of public data resources with functions including resource registration, operation management, development and utilization, and security supervision (hereinafter the “authorized-operation infrastructure”).
Operating institutions shall carry out data governance and development in the secure and controllable development environment provided by the implementing institution, to form basic public data products and services.
Article 13 (Other access platforms). Other already-built channels for the authorized operation of public data resources and platforms for development and utilization shall, once their functional positioning has been further clarified, comply with this Municipality’s administrative requirements and technical standards for the authorized operation of public data resources and be connected to the authorized-operation infrastructure in a secure and orderly manner.
Chapter IV Data Supply
Article 14 (On-chain registration and aggregation of public data resources). This Municipality’s public data resources shall be placed on-chain, catalogued, and classified and graded on the big-data resource platform, so as to achieve centralized and unified management and promote the aggregation and governance of public data resources.
The municipal data authority shall guide the implementing institution in preparing a catalogue of public data resources for authorized operation and shall increase the supply of public data that does not affect public security and whose sharing is not prohibited by laws or regulations.
Article 15 (Data supply by industry competent departments). Each industry competent department shall promote the supply of the public data of its own system and industry, guide its subordinate public institutions and state-owned enterprises to increase data supply, improve the quality of data supply and register public data resources, and coordinate and promote data interfacing between ministries and the Municipality.
Where genuinely necessary, an industry competent department may designate a subordinate public institution or state-owned enterprise as the business implementing entity, which shall, together with the implementing institution, formulate the relevant plan for the industry and implement data-supply responsibilities for industry data governance, quality management and the formulation of data standards, and report the same to the municipal data authority for consent.
Where a natural person, legal person or unincorporated organization expressly consents to the use of its public data, the industry competent department shall provide the data in accordance with law.
Article 16 (Integration of multi-source data). Operating institutions are encouraged actively to interface with the public data of national ministries and commissions, the Yangtze River Delta region and other provinces and municipalities, and to obtain non-public data lawfully and compliantly, for integrated development with this Municipality’s public data resources.
Industry competent departments and district data authorities are encouraged to build data innovation laboratories, explore sandbox regulatory mechanisms for data circulation, support the lawful, compliant and efficient development and utilization of multi-source data, carry out industry planning, business-format layout and model innovation, and expand innovative application scenarios for public data resources.
Chapter V Operation Management
Article 17 (Functions of operating institutions). An operating institution shall conduct business within the scope of its authorization in accordance with laws and regulations, and shall cooperate with the implementing institution in carrying out assessments of the qualifications of development entities and of application-scenario plans.
An operating institution shall not directly or indirectly participate in the re-development of public data products and services already delivered within the scope of the authorization; shall not engage in monopolistic conduct by concluding monopoly agreements with development entities or abusing a dominant market position; and shall not use advantages in data, algorithms, technology or capital to engage in acts of unfair competition.
Article 18 (Financial management). An operating institution shall strengthen the internal management of the costs, revenues and expenditures relating to public data products and services, keep dedicated accounts for the financial receipts and payments relating to public data products and services, and accept supervision in accordance with law.
The implementing institution shall strengthen internal-control audits of operating institutions in respect of the authorized operation of public data resources.
Article 19 (Pricing and revenue-distribution mechanism). The municipal data authority shall, together with the municipal development and reform, finance and state-owned assets departments and the relevant municipal industry competent departments, establish and improve the pricing and revenue-distribution mechanism for public data products and services.
Basic public data products and services provided by operating institutions that are used for public governance or public-welfare undertakings shall be used free of charge where conditions permit; operational products and services used for industrial development or sectoral development for which a charge is genuinely necessary shall be subject to government-guided pricing.
The reasonable distribution of the proceeds of the authorized operation of public data resources shall be promoted on the principle of “who invests, who contributes, who benefits,” protecting the lawful rights and interests of all participants. Implementing institutions, operating institutions and other participants are encouraged to support the data governance and service capacity-building of the Municipality, the districts and departments through technology, products and services in a lawful and compliant manner.
Chapter VI Development Management
Article 20 (Development entities). A development entity shall satisfy the conditions prescribed by the implementing institution; it shall re-develop the basic public data products and services delivered by the operating institution, integrate multi-source data, enhance the value of public data products and services, and promote scenario applications.
Article 21 (Scenario application and assessment). A development entity shall submit its application-scenario plan for public data resources to the implementing institution through the operating institution and undergo a compliance assessment of the application scenario.
Article 22 (Development of public data products and services). Development entities shall rely on the authorized-operation infrastructure and develop public data products and services in the public data authorized-operation domain in accordance with standard procedures. Districts are encouraged, based on their industrial foundations and functional positioning, to deploy physical space carriers for development environments in industrial parks or buildings.
Operating institutions and development entities shall not use public data resources beyond the scope of authorization. Public data involving personal information shall be anonymized, or obtained after the data source subject to which the relevant data points has given authorization and consent in accordance with law. This Municipality shall establish, through channels such as Suishenma (随申码), a convenient mechanism for data source subjects to give authorization and consent.
Article 23 (Release of public data products and services). Before releasing a public data product or service, a development entity shall submit an application to the operating institution. The operating institution shall be responsible for ensuring, in accordance with the application-scenario plan, the compliance, security and consistency of the release of public data products and services. The implementing institution shall strengthen process supervision and administration.
Qualifying public data products and services are encouraged to be registered in accordance with this Municipality’s policies on the registration of intellectual property rights in data products.
Chapter VII Security and Compliance
Article 24 (Security principles). Data security responsibility shall be implemented on the principle that “whoever collects, holds, operates or uses is responsible.”
For important data and personal information, on the premise of protecting national security, the public interest and personal privacy, the development of data value in accordance with laws and regulations is encouraged through approaches such as “raw data does not leave the domain, data is usable but not visible, and data is controllable and measurable.”
Article 25 (Security and compliance responsibilities). The implementing institution, operating institutions and development entities shall implement their primary responsibility for data security in light of their respective duties in the authorized operation of public data resources.
The implementing institution shall establish and improve mechanisms for monitoring, auditing and tracing the secure and compliant circulation of public data; implement the security-management requirements for the classification and grading of public data; strengthen technical support and data security management; and periodically assess the authorized-operation infrastructure to ensure that it is secure, reliable and efficient.
An operating institution shall establish and improve a full-lifecycle security and compliance management system for the public data within the scope of its authorization and strengthen internal-control, technical and personnel management, to ensure that data sources are lawful and traceable, destinations are ascertainable, conduct leaves a record and responsibility can be pursued.
A development entity shall ensure that the public data products and services it develops comply with the requirements of laws, regulations and standards, and shall protect personal information rights and interests, intellectual property rights, trade secrets and the like from infringement.
Article 26 (Security supervision). The municipal data authority shall, together with the relevant municipal industry competent departments and the municipal cyberspace and public security departments, establish and improve a working system for the classification and grading, risk assessment, monitoring and early warning, and emergency response of public data, and a whole-process security supervision system; establish coordinated supervision mechanisms for cybersecurity, data security and personal information protection; and strictly control the direct entry into the market of raw public data resources that have not been made public in accordance with laws and regulations.
Chapter VIII Supervision and Evaluation
Article 27 (Public disclosure of operations). The implementing institution and operating institutions shall, in accordance with regulations, periodically disclose to the public information on the authorized operation of public data resources and accept public supervision.
Article 28 (Assessment and evaluation). The municipal data authority shall be responsible for evaluating the effectiveness of the authorized operation of public data resources and for third-party assessment, and shall periodically assess the data supply of each industry competent department and business implementing entity; the assessment results shall serve as an important reference for the management of digitalization projects. Data-supply assessment results for state-owned enterprises shall simultaneously be included within the scope of major special tasks under this Municipality’s supervision of state-owned assets.
The implementing institution shall periodically conduct a comprehensive evaluation of operating institutions and report the results to the municipal data authority, as an important basis for the termination or revocation of an operating institution’s authorization or for its re-application for authorized operation.
Article 29 (Cultivating the ecosystem). This Municipality shall actively develop the data industry, coordinate the layout of the data industry and improve the technological innovation system. All districts and industry competent departments shall strengthen the planning and layout of application scenarios, promote innovative data applications, and cultivate public data development entities, grow the data services industry and foster a flourishing ecosystem of data businesses through policy support, incentive measures and industrial-development carriers. Public welfare and inclusiveness shall be advocated, supporting small, medium and micro enterprises and private enterprises in using data conveniently and efficiently, and reducing enterprises’ cost of using data.
Article 30 (Inclusiveness toward innovation). The authorized operation of public data resources shall be carried out on the principle of “supporting innovation, aligning powers with responsibilities, and exempting from liability those who have performed their duties diligently,” encouraging and protecting officials in taking responsibility and acting, and fostering an atmosphere of undertaking and entrepreneurship that encourages and tolerates innovation.
Article 31 (Cross-regional cooperation). Through promoting central–local coordination and regional cooperative development and implementing the national strategy for the integrated development of the Yangtze River Delta, this Municipality shall explore and innovate safeguard measures for the coordinated development and utilization of public data resources in the Yangtze River Delta region.
Chapter IX Supplementary Provisions
Article 32 (Application by reference). Relevant administrative units of central State organs stationed in this Municipality that carry out the authorized operation of public data resources and related administrative work may implement these Measures by reference.
Public-utility operating units for water supply, electricity supply, gas supply, public transport and the like shall, under the guidance of the relevant industry competent departments, apply these Measures in carrying out the authorized operation of public data resources and related administrative work. Where laws or regulations provide otherwise, those provisions shall prevail.
Article 33 (Interpretation). The municipal data authority shall be responsible for the specific interpretation of these Measures.
Article 34 (Date of implementation). These Measures shall come into force on the date of issuance.