---
title_en: "Ningxia Hui Autonomous Region Measures for the Administration of Authorized Operation of Public Data Resources (Trial)"
title_zh: "宁夏回族自治区公共数据资源授权运营管理办法（试行）"
abbreviation: "Ningxia Public Data Authorized Operation Measures"
hierarchy: "rule"
issuing_body: "Development and Reform Commission of Ningxia Hui Autonomous Region"
adopted_date: 2025-09-26
effective_date: 2025-11-01
status: "effective"
related_laws: ["public-data-authorized-operation-specifications", "public-data-registration-interim-measures", "public-data-development-utilization-opinions", "public-data-authorized-operation-pricing-notice", "shanghai-public-data-authorized-operation-measures", "dsl"]
domains: ["data-economy", "data-security"]
url: https://datacompliancechina.com/laws/ningxia-public-data-authorized-operation-measures/
summary: "Issued by the Development and Reform Commission of Ningxia Hui Autonomous Region (which also houses the regional Data Bureau) on September 26, 2025 as a local normative document (宁发改规发〔2025〕11号), effective November 1, 2025 and valid through October 31, 2027, these 33-article Measures localize the NDRC/NDA Implementation Specifications for the autonomous region. The Ningxia model departs from the national template in several respects: during a trial period capped at three years the whole region uses a single overall-authorization model, the implementing institution must be a public institution (事业单位) designated by the regional government, and the operating institution is chosen not by bidding but through a published solicitation, application and review with a public announcement of at least five working days. The Measures then build a full third tier — 'data developers' — who access public data on a 'one scenario, one application' basis through a five-working-day acceptance, joint review by the data administration department, implementing institution and data-source unit, and a development-and-utilization agreement filed with the regulator. All authorized operation runs through a single regional Data Element Comprehensive Service Platform; products for public governance are free, while industrial uses may bear an operating service fee under government-guided pricing set by the DRC. A dedicated data security and supervision chapter assigns primary security responsibility to all three tiers."
---

> **Source: Data Compliance China** — https://datacompliancechina.com/laws/ningxia-public-data-authorized-operation-measures/ · English rendering and annotations by DCC; the Chinese original governs. Cite as: Data Compliance China, "Ningxia Hui Autonomous Region Measures for the Administration of Authorized Operation of Public Data Resources (Trial)", https://datacompliancechina.com/laws/ningxia-public-data-authorized-operation-measures/
**Promulgated by:** Development and Reform Commission of Ningxia Hui Autonomous Region (宁夏回族自治区发展和改革委员会).  
**Document No.:** 宁发改规发〔2025〕11号 (Ning Fa Gai Gui Fa [2025] No. 11).  
**Issued September 26, 2025. Effective November 1, 2025. Valid through October 31, 2027.**

> *Translation note — DCC. Translated in full from the official Chinese text
> of the issuing notice and the Measures (local normative document, currently
> in force). The Measures implement the national
> [Implementation Specifications for Authorized Operation of Public Data Resources (Trial)](/laws/public-data-authorized-operation-specifications/)
> and the central
> [Opinions on Accelerating the Development and Utilization of Public Data Resources](/laws/public-data-development-utilization-opinions/).
> Terminology follows DCC's bilingual glossary.*

---

## Notice on Issuing the Ningxia Hui Autonomous Region Measures for the Administration of Authorized Operation of Public Data Resources (Trial)

To all relevant departments, the Ningdong Administrative Committee, relevant central units stationed in Ningxia, the data bureaus of the five prefecture-level cities, and all large enterprises:

In order to advance the authorized operation of public data in a regulated and orderly manner, and pursuant to the *Opinions of the General Office of the CPC Central Committee and the General Office of the State Council on Accelerating the Development and Utilization of Public Data Resources*, the *Implementation Specifications for Authorized Operation of Public Data Resources (Trial)* (Fa Gai Shu Ju Gui [2025] No. 27) and other relevant policies and norms, this Commission has formulated the *Ningxia Hui Autonomous Region Measures for the Administration of Authorized Operation of Public Data Resources (Trial)*, which are hereby issued for compliance and implementation.

Development and Reform Commission of Ningxia Hui Autonomous Region

September 26, 2025

---

## Ningxia Hui Autonomous Region Measures for the Administration of Authorized Operation of Public Data Resources (Trial)

## Chapter I General Provisions

**Article 1.** These Measures are formulated in accordance with the *Opinions of the General Office of the CPC Central Committee and the General Office of the State Council on Accelerating the Development and Utilization of Public Data Resources*, the *Implementation Specifications for Authorized Operation of Public Data Resources (Trial)* and other relevant provisions, in order to regulate the administration of the authorized operation of public data resources and accelerate the cultivation of the data factor market.

**Article 2.** These Measures apply to public data resource authorized-operation activities carried out within the administrative area of the Autonomous Region.

**Article 3.** "Authorized operation of public data resources" refers to the activity of authorizing qualified operating institutions, in accordance with laws, regulations and relevant administrative requirements, to govern and develop the public data resources of the Autonomous Region, and to provide data products and services fairly to the market.

"Implementing institution" refers to the public institution (事业单位) determined by the People's Government of the Autonomous Region through standardized procedures to be specifically responsible for organizing and conducting authorized-operation activities.

"Operating institution" refers to a legal-person organization that has obtained authorization through standardized procedures and that develops and operates the public data resources within the scope of the authorization.

"Data developer" (数据开发商) refers to a legal person or unincorporated organization that develops data resources by scenario, forms data products and services, and provides data services to government departments and society.

**Article 4.** The authorized operation of public data resources shall establish a public data resource authorized-operation mechanism in which the administrative body, the implementing institution, the operating institution and data developers coordinate with one another.

**Article 5.** The authorized operation of public data resources shall attach equal importance to security and development; follow the principles of legality and compliance, fairness and impartiality, public-interest priority, reasonable returns, security and controllability, and "whoever operates is responsible, and whoever uses is responsible"; and, in accordance with the requirement that "raw data does not leave its domain; data is usable but not visible" (原始数据不出域、数据可用不可见), and on the premise of not endangering national security or the public interest and not infringing trade secrets, personal privacy, personal information rights and interests or other lawful rights and interests, promote the development and utilization and orderly circulation of public data resources.

**Article 6.** During the trial period, the authorized operation of public data resources across the Region shall adopt the overall-authorization model, and data developers shall develop and utilize public data on a "one scenario, one application" basis. The trial period shall not exceed three years, after which the authorization model shall be re-determined in light of actual development.

## Chapter II Authorized-Operation Procedure

**Article 7.** Authorized-operation work shall proceed according to the following procedure: preparation of the plan, study and deliberation, selection and determination of the operating institution, execution of the agreement, filing administration, operation and implementation, and termination and exit.

**Article 8.** The public data resource authorized-operation implementation plan shall be prepared under the lead of the data administration department of the Autonomous Region, or by the implementing institution under its guidance.

The implementation plan shall include the following content: the name of the authorized operation; a demonstration of necessity and feasibility; the selection criteria for the operating institution; the authorized-operation model; the scope of data resources under authorized operation, the data resource catalogue, the data update frequency and the state of data quality; the authorized-operation term, construction content, technical safeguards, implementation schedule, evaluation criteria, exit mechanism and asset management; the list of proposed public data products and services; the accounting mechanism for operating costs and revenue within the operating institution's authorized scope and the revenue distribution mechanism; data security and personal information protection measures and emergency-response measures; the rights and obligations of the implementing institution, the operating institution and other relevant participants; supervision and administration and assessment and evaluation requirements; and other matters that should be clarified.

**Article 9.** The implementation plan shall be submitted to the people's government at the same level and implemented after deliberation and approval in accordance with the "three majors and one large" (三重一大) decision-making mechanism.

Where an examined and approved implementation plan genuinely needs to be changed or undergoes a major adjustment, it shall be resubmitted to the people's government at the same level for deliberation.

**Article 10.** The implementing institution shall, in accordance with the requirements of the relevant national and regional laws and regulations and on the basis of the content prescribed in the implementation plan, determine the operating institution through fair-competition methods.

The determination of the operating institution shall proceed through the procedures of information publication, submission of applications, and review and public announcement:

(I) Information publication. The implementing institution shall publish a solicitation announcement for the authorized operation of public data resources, specifying the application conditions and requirements for the operating institution;

(II) Submission of applications. Prospective applicant units shall submit the relevant application materials to the implementing institution within the prescribed period;

(III) Review and public announcement. The implementing institution shall conduct the review together with the data administration department and shall publicly announce the review results; the public announcement period shall be no less than five working days.

**Article 11.** Upon completion of the public announcement, the implementing institution shall promptly enter into a public data resource authorized-operation agreement with the operating institution.

The authorized-operation agreement shall include the scope and data resource catalogue of the public data resources under authorized operation, the operating term, the list of proposed public data products and services and the technical standards, security review requirements and business-compliance review requirements applicable to them, the technical support platform for the public data resource authorized-operation work, asset ownership, information-disclosure requirements regarding the authorized operation, accounting requirements for operating costs and revenue, the revenue distribution mechanism, liability for breach of contract, and other content.

Before execution, the authorized-operation agreement shall be deliberated and approved by the implementing institution's "three majors and one large" decision-making mechanism. After execution, the implementing institution shall file the agreement with the data administration department of the Autonomous Region.

**Article 12.** Where the operating institution breaches the public data resource authorized-operation agreement, the authorized operation shall be suspended immediately. Where the breach is promptly corrected and its adverse effects eliminated during the suspension, the authorized operation shall be resumed after the data administration department of the Autonomous Region has organized the implementing institution to conduct an inspection and evaluation. Where the breach is not promptly corrected and causes serious consequences or major losses, the matter shall be handled under the breach-of-contract provisions of the authorized-operation agreement, and, upon report to and approval by the people's government at the same level, the authorized-operation agreement shall be terminated and the operating institution's authorized-operation qualification revoked.

The data administration department of the Autonomous Region shall take the lead in, or guide the implementing institution in, establishing an authorized-operation assessment mechanism. Where an assessment is failed, the authorized-operation agreement shall be terminated according to procedure, or another authorized-operation model adopted.

## Chapter III Procedure for the Development and Utilization of Data Resources

**Article 13.** A data developer that develops and utilizes public data resources shall determine its data-use needs according to the scenario and submit a data-use application in accordance with the application procedure for development and utilization; the operating institution shall process the application according to procedure after accepting it.

Where data-use needs change, a new application shall be submitted.

**Article 14.** Development and utilization shall proceed according to the procedures of acceptance of the application, execution of the agreement, and filing administration.

**Article 15.** A data developer shall submit a development-and-utilization application to the operating institution. The application materials shall include the applicant's qualifications, the application scenario, the public data required, the method of development and utilization, and security safeguard measures.

The operating institution shall form an acceptance opinion within five working days of receiving the application materials and refer it to the data administration department, the implementing institution and the data-source unit for joint review.

The data administration department, the implementing institution and the data-source unit shall complete their review within five working days of receiving the acceptance opinion, and issue a review opinion stating its basis.

The operating institution shall promptly convey the acceptance opinion and review opinion to the data developer; the data developer may, on the basis of those opinions, improve and supplement its application materials and continue to submit its application.

**Article 16.** Within five working days after the application has been accepted, the operating institution shall enter into a public data resource development-and-utilization agreement with the data developer.

The agreement shall include the rights and obligations of both parties, the application scenario, the scope of public data, the conditions for development and utilization, data security requirements, service fees, liability for breach of contract, and other content.

Within five working days after the agreement is executed, the operating institution shall file it with the data administration department and open the development-and-utilization rights for the relevant data to the data developer.

**Article 17.** Where a data developer breaches the public data resource development-and-utilization agreement by failing to develop and utilize data in accordance with the purpose and application scenario specified in the agreement, and no serious consequences have been caused, the operating institution shall order rectification within a specified period. Where rectification is completed within the agreed period and the adverse effects are promptly eliminated, the data developer may continue its public data development and utilization activities under the agreement after passing an acceptance inspection organized by the data administration department of the Autonomous Region with the implementing institution and the operating institution. Where rectification is not completed within the period or serious consequences have been caused, the operating institution has the right to rescind the agreement and proceed under the breach-of-contract provisions.

## Chapter IV Work Requirements for the Implementing Institution

**Article 18.** The implementing institution shall possess a certain level of data management capacity and technical support capacity, and shall be responsible for formulating the implementation plan, guiding operational business, and constructing and managing the data service platform.

**Article 19.** The implementing institution shall carry out its work in accordance with the following requirements:

(I) Strictly implement the relevant national and regional provisions, and determine the authorized operating institution openly, transparently, scientifically and prudently;

(II) Establish and improve a secure and controllable development and utilization environment, and ensure that the entire process of data resource development and utilization is manageable, controllable and traceable;

(III) Promptly conduct, or organize the operating institution or a duly qualified third-party institution to conduct, security-compliance review of data applications and products developed from public data resources;

(IV) Cooperate with the data administration department of the Autonomous Region in formulating and improving unified data-governance standards and norms for the Region, and carry out data-governance activities together with the sectoral competent departments and the operating institution;

(V) Establish a monitoring system for fair market competition and market operations, regularly conduct internal-control audits of operating activities, and guard against the risk of data monopoly; cooperate with the data administration department in establishing a disclosure mechanism for the operating results of public data resource authorized operation; and review the state of the authorized operation, including the authorized parties, content, scope and term, and the revenue from operating services;

(VI) Regularly disclose to society the state of use of public data resources, make public the authorized parties, content, scope and term and the list of public data products and services, and accept social supervision;

(VII) Establish a public data resource contribution evaluation indicator system and a performance evaluation system, and evaluate data aggregation and governance, development and opening, and related work from dimensions such as data quality and application scenarios;

(VIII) Perform other duties in the course of the authorized operation of public data resources.

**Article 20.** In carrying out public data resource authorized-operation activities, the implementing institution shall not exclude or restrict fair market competition, and shall not interfere with or affect the authorized operation and the development and utilization of public data resources.

## Chapter V Work Requirements for the Operating Institution

**Article 21.** The operating institution shall have sound business standing and possess the professional qualifications, highly skilled personnel and operating service capacity required for the operation of data resources.

**Article 22.** The operating institution shall carry out its work in accordance with the following requirements:

(I) Strictly implement its primary responsibility for data security, and establish an internal management and security assurance system for the authorized operation of public data resources;

(II) Establish and improve mechanisms for the routine monitoring, risk assessment and security review of the market operation of public data resources, form a full-process record of the use of public data resources, and ensure that the entire process of public data resource management, development and utilization, and service support is secure and controllable;

(III) Formulate an emergency-response plan for data security incidents; when a data security incident such as data loss, leakage, tampering or destruction occurs, or a major risk arises, immediately activate the emergency-response plan and report to the implementing institution, the data administration department and the cyberspace administration department at the same level;

(IV) Where, in the course of data processing, service provision or use, it discovers that implicit relationships or patterns among data may endanger national security or the public interest, or infringe personal privacy or disclose trade secrets, immediately cease the relevant activities and promptly report the risk to the implementing institution and the data administration department;

(V) Make public the list of public data products and services, disclose the state of use of public data resources, and accept social supervision;

(VI) During the operating term, submit an annual report on the operation of public data resources to the implementing institution. The report shall cover the storage, processing, analysis and utilization, security management and market operation of the data products and services related to the operation, among other matters;

(VII) Adhere to the principles of legality and compliance, inclusiveness and fairness, and reasonable returns, and provide data products and services fairly to the market. Products and services used for public governance and public-interest undertakings shall be provided free of charge; for those used for industrial development and sectoral development, a public data resource operating service fee may be charged, subject to government-guided pricing (政府指导价), with the fee standards formulated by the Development and Reform Commission of the Autonomous Region together with the relevant departments;

(VIII) In accordance with the financial management system, strengthen the internal management of the costs, revenue and expenditure of public data resource operating services, and accept supervision in accordance with law.

**Article 23.** The operating institution shall conduct business within the scope of the authorization in accordance with laws and regulations, shall not engage in monopolistic conduct such as reaching monopoly agreements with other operating entities or abusing a dominant market position, shall not engage in acts of unfair competition, and shall not directly or indirectly participate in the further development of public data products and services within the authorized scope.

## Chapter VI Rights and Obligations of Data Developers

**Article 24.** A data developer shall develop and utilize public data resources within the application scenario for which it applied, form data products and services, and shall not arbitrarily expand the scope of application of the data resources.

**Article 25.** The property income obtained by a data developer from commercial public data products and services lawfully developed by it is protected by law, except in any of the following circumstances:

(I) Where the data products and services contain personal data for which authorization has not been lawfully obtained;

(II) Where the data products and services contain public data that has not been authorized or licensed;

(III) Other circumstances provided for by laws and regulations.

**Article 26.** A data developer shall abide by the principle of fair competition and shall not engage in the following acts that infringe the lawful rights and interests of other market entities:

(I) Obtaining data resources by unlawful means;

(II) Using data resources obtained by unlawful means to provide substitute products or services;

(III) Other acts prohibited by laws and regulations.

## Chapter VII Data Security and Supervision and Administration

**Article 27.** The implementing institution, the operating institution and data developers shall perform their primary responsibility for data security; regularly conduct policy interpretation and legal publicity; strengthen internal-control management, technical management and personnel management; increase investment in data security protection technology and funding; enhance their capacity to identify risks from data correlation and aggregation; strictly guard against security risks at the stages of data processing, handling, operation and service; and ensure that public data resource authorized-operation activities run smoothly and in an orderly manner.

**Article 28.** The Data Element Comprehensive Service Platform (数据要素综合服务平台) is the unified channel for the authorized operation of public data resources in the Autonomous Region. It shall be planned and constructed by the Autonomous Region on a unified basis; the cities (counties, districts) shall in principle not build duplicate platforms, and may access and use it through tiered deployment, the opening of dedicated zones and similar means.

**Article 29.** Authorized operation shall effectively identify and control security hazards arising from improper operations, and promptly prevent and defuse financial risks and other social risks.

**Article 30.** Where an operating institution or data developer violates the relevant laws and regulations on cybersecurity, data security, personal information protection or the like, the matter shall be handled in accordance with law by the cyberspace administration, public security and other departments according to their duties.

## Chapter VIII Supplementary Provisions

**Article 31.** Where public data resource authorized operation was already carried out before the issuance of these Measures, it shall be regularized and improved with reference to these Measures.

**Article 32.** The Development and Reform Commission (Data Bureau) of the Autonomous Region is responsible for the interpretation of these Measures.

**Article 33.** These Measures take effect from November 1, 2025 and are valid through October 31, 2027.