Promulgated by: General Office of the Zhengzhou Municipal People’s Government.
Document No.: 郑政办〔2026〕15号 (Zheng Zheng Ban [2026] No. 15).
Issued April 23, 2026. Effective April 23, 2026 (valid for two years).
Translation note — DCC. Translated in full from the official Chinese text of the issuing notice and the Measures. Terminology follows DCC’s bilingual glossary and the usage in the national Implementing Specifications for the Authorized Operation of Public Data Resources (Trial). “Three majors and one large” (三重一大) is the collective decision-making mechanism for major decisions, major appointments, major projects and large expenditures; the “three distinctions” (三个区分开来) is the Party principle for distinguishing good-faith mistakes from misconduct.
Notice on Issuing the Zhengzhou Municipality Measures for the Administration of Authorized Operation of Public Data Resources (Trial)
To the administrative committees of all development zones, the people’s governments of all districts and counties (cities), all departments of the Municipal People’s Government and all relevant units:
The Zhengzhou Municipality Measures for the Administration of Authorized Operation of Public Data Resources (Trial) have been approved by the Municipal Government and are hereby issued to you. Please implement them conscientiously.
General Office of the Zhengzhou Municipal People’s Government
April 23, 2026
Zhengzhou Municipality Measures for the Administration of Authorized Operation of Public Data Resources (Trial)
Chapter I General Provisions
Article 1. These Measures are formulated in accordance with the Data Security Law of the People’s Republic of China, the Personal Information Protection Law of the People’s Republic of China, the Opinions of the CPC Central Committee and the State Council on Building a Basic Data System to Better Bring into Play the Role of Data Elements, the Opinions of the General Office of the CPC Central Committee and the General Office of the State Council on Accelerating the Development and Utilization of Public Data Resources, the Notice of the National Development and Reform Commission and the National Data Administration on Issuing the Implementing Specifications for the Authorized Operation of Public Data Resources (Trial) (发改数据规〔2025〕27号), the Notice of the General Office of the Henan Provincial People’s Government on Issuing the Henan Province Implementing Measures for the Authorized Operation of Public Data Resources (Trial) (豫政办〔2025〕5号) and other relevant laws, regulations and policy provisions, and in light of the actual conditions of this Municipality, in order to regulate and promote the development and utilization of public data resources and fully release the value of data elements.
Article 2. These Measures apply to the authorized operation of public data resources and related administrative work carried out within the administrative area of this Municipality.
Article 3. The authorized operation of public data resources shall follow the principles of lawfulness and compliance, fairness and impartiality, priority to the public interest, reasonable returns, and security and controllability.
Article 4. For the purposes of these Measures, “public data resources” means collections of data of utilization value generated by Party and government organs at all levels and enterprises and public institutions of this Municipality in the course of performing their duties in accordance with law or providing public services.
“Authorized operation of public data resources” means the activity of authorizing, in accordance with laws, regulations and relevant requirements, qualified operating institutions to govern and develop public data resources and to provide data products and technical services to the market on a fair basis.
“Operating institution” means a legal-person organization that undertakes the authorized operation of public data resources in accordance with these Measures, including the construction of the platform for the authorized operation of public data resources, data processing, management of development and utilization, support for service capabilities, cultivation of the market ecosystem and security safeguards.
“Development entity” means a legal-person organization that, in accordance with these Measures, deeply processes primary-processed public data resources to form data products and services and provides them to society.
Article 5. The municipal data authority shall be responsible for organizing and carrying out the authorized operation of public data resources across the Municipality, improving the relevant policies, management systems and standards for the authorized operation of public data resources, undertaking the administration of the authorized operation of public data resources, and guiding and supervising the authorized operation of public data resources across the Municipality.
Each industry competent department shall be responsible for the preparation of the public data resource catalogue, the aggregation of public data resources and data-quality management for its department and industry, and shall cooperate in the administration of the authorized operation of public data resources.
The municipal data authority shall, together with the industry competent departments, formulate the catalogue of public data resources available for authorized operation, update it dynamically according to demand for the use of public data resources, and publish it through open channels.
The development and reform, finance, market regulation, taxation and other departments shall be responsible, in accordance with their respective duties, for the business supervision of the authorized operation of public data resources.
The cyberspace, public security, state security, secrecy and other departments shall be responsible, in accordance with their respective duties, for the security supervision of the authorized operation of public data resources.
Article 6. The public data resources of this Municipality shall be subject to unified authorized operation by the Municipal People’s Government, adopting the whole-authorization model. The municipal data authority shall determine the operating institution in accordance with laws and regulations, sign an authorized-operation agreement, and authorize it to carry out the operation of public data.
Article 7. The public data resources of this Municipality may be included within the scope of authorized operation on the premise of not endangering national security or the public interest and not infringing trade secrets, personal privacy or personal information rights and interests. Where public data resources of another region or department obtained by way of government data sharing are used for authorized operation, the consent of the unit providing the shared data shall be obtained.
Article 8. The operating institution shall not directly or indirectly participate in the re-development of public data products and services already delivered within the scope of the authorization, shall not abuse a dominant market position to engage in monopolistic conduct or unfair competition, and shall not sub-authorize. Development entities are encouraged to re-develop the public data products and services provided by the operating institution.
Chapter II Authorization of Operation
Article 9. The municipal data authority shall take the lead in organizing the preparation of the implementation plan for the authorized operation of public data resources. The implementation plan shall balance economic and social benefits and ensure that it is implementable and can be put into practice.
Article 10. The implementation plan shall include the following:
(1) the name of the authorized operation;
(2) a study of the necessity and feasibility of the authorized operation;
(3) the selection criteria for the operating institution, including capital, management, technology, service and security capabilities;
(4) the authorized-operation model;
(5) the scope of data resources under authorized operation, the data resource catalogue, the frequency of data updates and the state of data quality;
(6) the term of authorized operation, construction content, technical safeguards, implementation schedule, evaluation standards, exit mechanism and asset management;
(7) the list of public data products and services to be provided, which shall cover the two major categories of support for public governance and public-welfare undertakings and for industrial and sectoral development, together with the expected forms of products and services;
(8) the mechanism for accounting for the operating institution’s operating costs and revenues within the scope of the authorization, and the revenue-distribution mechanism;
(9) data security and personal information protection measures and emergency-response measures;
(10) the rights and obligations of the data authority, the operating institution and the other participants;
(11) the supervision and administration and assessment and evaluation requirements for the authorized operation;
(12) other matters that should be specified.
Article 11. The municipal data authority shall be responsible for submitting the implementation plan for the authorized operation of public data resources, in accordance with the requirements of the “three majors and one large” decision-making mechanism, to the Municipal People’s Government for deliberation and approval before implementation.
An implementation plan approved after deliberation shall not, in principle, be changed at will; where a major change is genuinely necessary, it shall be re-submitted for deliberation and approval in accordance with the original process.
Article 12. The municipal data authority shall, in accordance with the approved implementation plan and the requirements of laws and regulations, select the operating institution by fair-competition methods such as public tender, invited tender or negotiation.
The municipal data authority shall sign an agreement on the authorized operation of public data resources with the operating institution selected in accordance with law. The content of the authorized-operation agreement shall fully take into account the views of all parties; content involving revenue distribution shall be referred to the municipal finance department for its views; and the agreement shall be signed after deliberation and approval under the municipal data authority’s “three majors and one large” decision-making mechanism.
Article 13. An agreement on the authorized operation of public data resources shall include the following:
(1) the scope of public data resources under authorized operation and the data resource catalogue;
(2) the term of operation, which in principle shall not exceed three years;
(3) the list of public data products and services to be provided and their technical standards, security review requirements and business-normativity review requirements;
(4) the technical support platform for the authorized operation of public data resources;
(5) ownership of assets, including ownership of software and hardware equipment and of public data products and services;
(6) requirements for the disclosure of information on the authorized operation;
(7) the requirements for accounting for the operating institution’s operating costs and revenues within the scope of the authorization, and the revenue-distribution mechanism;
(8) data security and personal information protection requirements and risk-monitoring and emergency-response measures;
(9) evaluation of operating effectiveness and the renewal or exit mechanism;
(10) liability for breach;
(11) the method of dispute resolution;
(12) the conditions for amendment and termination of the agreement;
(13) other matters that need to be specified.
Chapter III Operating Platform
Article 14. The municipal data authority shall guide the operating institution in building a platform for the authorized operation of public data resources (hereinafter the “operating platform”). The operating platform shall comply with the relevant national, provincial and municipal standards, provide the necessary software and hardware environment and technical support for the authorized operation of public data resources, and meet the government’s needs for evaluation and supervision. All participants in the authorized operation of public data resources shall rely on the operating platform to carry out authorized-operation activities.
Article 15. The operating platform shall comply with the standards for the multi-level protection of cybersecurity and the requirements for security assessment of commercial cryptography applications, establish a trusted authorization and authentication channel and a secure data-circulation channel, and ensure the stable operation of the platform and that the process of developing and utilizing data resources is manageable, controllable and traceable.
Chapter IV Development and Utilization
Article 16. A development entity shall satisfy the following conditions:
(1) it possesses the capability to develop and utilize data products and services in the field for which it applies;
(2) the enterprise has premises for production and operation appropriate to engaging in the relevant data industry (whether owned or leased), a development environment including software and hardware facilities, and the personnel (number and proportion of professional technical staff, professional-title levels and the like) and technical support capabilities relevant to the services it provides;
(3) the enterprise operates in good faith; the enterprise as a legal person has no adverse records such as administrative penalties or inclusion in lists of seriously dishonest entities in public credit inquiries, and its legal representative and other senior management personnel have not been included in lists of seriously dishonest entities;
(4) for enterprises that have received national or provincial science and technology awards in the data field, the application conditions may be appropriately relaxed.
Article 17. The operating institution shall formulate rules for the admission of development entities, rules for the development and utilization of data resources and security responsibility norms, which shall be implemented after review and consent by the municipal data authority.
The operating institution shall formulate a management system for development entities, specify the management requirements for development entities, and supervise and manage the conduct of development entities by various means such as contractual constraints and annual evaluation.
Article 18. The operating institution shall sign an agreement on the development and utilization of public data resources with each development entity. The agreement shall specify the rights and obligations of the parties, security requirements, revenue distribution, prohibited clauses and liability for breach; the term of development and utilization shall in principle not exceed three years.
Article 19. The operating institution shall, on the principle that “raw data does not leave the domain and data is usable but not visible,” and in accordance with the development and utilization agreement, provide primary-processed public data resources to development entities through the operating platform.
Article 20. Raw data shall not be exported from the operating platform; data products and services developed and exported from the operating platform shall not be capable of restoring raw data through reversible models or algorithms.
Article 21. Public data products and services shall comply with the relevant systems and norms for data circulation and trading; trading through data trading venues is encouraged.
Article 22. The municipal data authority and the finance department shall, on the principle of “who invests, who contributes, who benefits,” establish and improve the mechanism for managing and distributing the proceeds of the authorized operation of public data resources and safeguard the asset rights and interests in data resources in accordance with laws and regulations. The establishment of incentive mechanisms shall be studied and explored to protect the lawful and reasonable receipt of proceeds by all participants in the authorized operation of public data resources.
Chapter V Operation Management
Article 23. The operating institution shall submit annually to the municipal data authority a summary report on the authorized operation of public data resources, mainly covering the transmission and storage, processing, development and utilization, security management and market operation of public data resources.
Article 24. The municipal data authority shall conduct an annual evaluation of the overall state of the operating institution’s authorized operation of public data resources and shall promptly report to the Municipal People’s Government on major matters arising in the course of operation.
Chapter VI Security and Supervision
Article 25. In the course of the authorized operation of public data resources, the data security responsibility system under which “whoever manages is responsible and whoever uses is responsible” shall be implemented.
The municipal data authority shall, together with the relevant departments, establish and improve the security management mechanism for the authorized operation of public data resources, formulate security-protection rules, norms and technical standards for security review, risk assessment, monitoring and early warning, and emergency response in authorized operation, and strengthen internal-control audits of the operating institution in respect of the authorized operation of public data resources.
The operating institution shall strictly implement the relevant management systems for the authorized operation of public data resources; establish whole-process management mechanisms for the storage, transmission, governance and other links of public data resources, ensuring that data sources are traceable, destinations ascertainable, conduct leaves a record and responsibility can be pursued; periodically conduct security emergency drills and security risk assessments in accordance with laws, regulations and the requirements of the multi-level protection of cybersecurity; and properly retain data security logs and conduct risk screening.
Article 26. Where the operating institution violates the requirements of laws and regulations on cybersecurity, data security, personal information protection or the like, the cyberspace, public security, state security, secrecy, market regulation and other departments shall pursue its liability in accordance with law and their duties.
Article 27. The municipal data authority and the operating institution are encouraged and supported, in light of actual conditions, in actively exploring innovative measures conducive to the authorized operation and development and utilization of public data resources; where mistakes or deviations occur in the course of exploration and the prescribed conditions are met, liability may be exempted or mitigated in accordance with the principle of the “three distinctions” and the relevant national and provincial provisions.
Chapter VII Supplementary Provisions
Article 28. These Measures shall come into force on the date of issuance and shall be valid for two years.