---
title_en: "Zhaoqing Municipality Administrative Measures for the Authorized Operation of Public Data Resources (Trial)"
title_zh: "肇庆市公共数据资源授权运营管理办法（试行）"
abbreviation: "Zhaoqing Public Data Authorized Operation Measures"
hierarchy: "rule"
issuing_body: "Zhaoqing Municipal People's Government"
adopted_date: 2025-04-29
effective_date: 2025-05-01
status: "effective"
related_laws: ["public-data-authorized-operation-specifications", "public-data-registration-interim-measures", "public-data-development-utilization-opinions", "public-data-authorized-operation-pricing-notice", "shanghai-public-data-authorized-operation-measures", "dsl"]
domains: ["data-economy", "data-security"]
url: https://datacompliancechina.com/laws/zhaoqing-public-data-authorized-operation-measures/
summary: "Issued by the Zhaoqing Municipal People's Government (Guangdong) on April 29, 2025 after adoption at the 92nd executive meeting of the 14th Municipal Government, and effective May 1, 2025 for a three-year trial period, these 33-article Measures are one of the earliest prefecture-level implementations of the NDRC/NDA Implementation Specifications. Zhaoqing's model is distinctive for its four-tier chain of actors: the Municipal Government Affairs and Data Bureau acts as the 'data management institution', a municipal-government-designated implementing institution selects the operating institution through public bidding, invited bidding or negotiation, and the operating institution in turn licenses 'development institutions' scenario by scenario under a 'one scenario, one authorization, one scenario, one approval' rule. The data flow runs through two infrastructures — the municipal government big-data platform and a municipal public-data-resource operation service platform — with each tier bearing primary security responsibility for its own segment. Public-governance and public-welfare products are conditionally free; commercial products follow national pricing policy. Counsel structuring data-product ventures in the Greater Bay Area hinterland will find the platform-segmented liability allocation in Article 29 the most practically important provision."
---

> **Source: Data Compliance China** — https://datacompliancechina.com/laws/zhaoqing-public-data-authorized-operation-measures/ · English rendering and annotations by DCC; the Chinese original governs. Cite as: Data Compliance China, "Zhaoqing Municipality Administrative Measures for the Authorized Operation of Public Data Resources (Trial)", https://datacompliancechina.com/laws/zhaoqing-public-data-authorized-operation-measures/
**Promulgated by:** Zhaoqing Municipal People's Government.  
**Document No.:** not stated in the source text (issuing notice carries no document number).  
**Issued April 29, 2025. Effective May 1, 2025. Three-year validity period.**

> *Translation note — DCC. Translated in full from the official Chinese text
> of the issuing notice and the Measures (local normative document, 效力级别:
> 地方规范性文件). The source reproduces the term 数据主体 ("data subject"),
> which DCC preserves as the drafter's choice. Terminology otherwise follows
> DCC's bilingual glossary and the [Implementation Specifications for Authorized
> Operation of Public Data Resources (Trial)](/laws/public-data-authorized-operation-specifications/),
> which these Measures expressly incorporate by reference.*

---

## Notice of the Zhaoqing Municipal People's Government on Issuing the Zhaoqing Municipality Administrative Measures for the Authorized Operation of Public Data Resources (Trial)

To the people's governments of all counties (county-level cities and districts), the administrative committees of Zhaoqing High-Tech Zone, Zhaoqing New Area and the Guangdong–Guangxi Cooperation Pilot Zone (Zhaoqing), and all departments and directly subordinate units of the Municipal Government:

The *Zhaoqing Municipality Administrative Measures for the Authorized Operation of Public Data Resources (Trial)* have been deliberated and adopted at the 92nd executive meeting of the 14th Municipal Government and are hereby issued to you. Please implement them conscientiously. Problems encountered in the course of implementation should be reported directly to the Municipal Government Affairs and Data Bureau.

Zhaoqing Municipal People's Government  
April 29, 2025

---

## Zhaoqing Municipality Administrative Measures for the Authorized Operation of Public Data Resources (Trial)

## Chapter I General Provisions

**Article 1.** These Measures are formulated in accordance with the Cybersecurity Law of the People's Republic of China, the Data Security Law of the People's Republic of China, the Personal Information Protection Law of the People's Republic of China and other laws and regulations, and pursuant to the requirements of the *Opinions of the CPC Central Committee and the State Council on Building a More Complete Market-Based Allocation Mechanism for Factors of Production*, the *Opinions of the CPC Central Committee and the State Council on Building a Fundamental Data System to Better Leverage the Role of Data as a Factor of Production*, the *Opinions of the General Office of the CPC Central Committee and the General Office of the State Council on Accelerating the Development and Utilization of Public Data Resources* and the *Implementation Specifications for Authorized Operation of Public Data Resources (Trial)*, in light of the actual circumstances of this Municipality, in order to regulate the administration of the authorized operation of public data resources, promote the reform of the market-oriented allocation of data elements in this Municipality, and advance the healthy development of digital government, digital society and the digital economy.

**Article 2.** These Measures apply to data activities relating to the authorized operation of public data resources — aggregation, authorization, processing, business operation, circulation, supervision, security safeguards and the like — carried out by municipal-level administrative organs and by public administration and service institutions funded by the municipal-level treasury.

The following data shall not be included within the scope of authorized operation of public data resources: public data classified as not-to-be-opened that has not undergone de-classification or de-sensitization treatment; public data for which the authorization of the data subject has not been obtained; and public data that is confidential in accordance with the law.

**Article 3.** "Public data resources" means valuable collections of data generated by public administration and service institutions in the course of performing their duties in accordance with the law or providing public services.

"Authorized operation" means the activity of authorizing, in accordance with laws, regulations and relevant requirements, qualified operating institutions to govern and develop public data resources and to provide data products and technical services fairly to the market.

"Data management institution" (数据管理机构) means the unit responsible for the overall coordination and administration of the authorized operation of public data resources throughout the Municipality, for dynamically monitoring the state of authorized operation of public data resources throughout the Municipality, and for strengthening policy and operational guidance.

"Implementing institution" means the unit, determined by the Municipal People's Government in conjunction with the authorization model, that is specifically responsible for organizing and carrying out authorized-operation activities.

"Operating institution" means a legal person or unincorporated organization that has obtained authorization in accordance with laws, regulations and procedures and that processes and operates public data resources within the scope of authorization.

"Development institution" (开发机构) means a legal person or unincorporated organization that has obtained authorization from an operating institution in accordance with laws and regulations and that carries out the development and business operation of public data products and services relying on the municipal public-data-resource operation service platform.

"Data-source institution" (数源机构) means an administrative organ at any level, or a public administration and service institution funded by the treasury at any level, within this Municipality that collects public data in accordance with laws and regulations.

"Data subject" means the natural person, legal person or unincorporated organization to which the relevant data relates.

**Article 4.** The authorized operation of public data resources shall place equal emphasis on development and security and follow the principles of legality and compliance, fairness and impartiality, public-interest priority, reasonable returns, and security and controllability.

**Article 5.** In carrying out activities for the authorized operation of public data resources, administrative power or market dominant position shall not be abused to exclude or restrict competition, and advantages in data, algorithms, technology, capital or the like shall not be used to engage in monopolistic conduct.

**Article 6.** The authorized operation of public data resources shall undergo security review in accordance with the law, safeguard national security and the social public interest, and protect State secrets, trade secrets and personal privacy.

**Article 7.** The Municipal Government Affairs and Data Bureau, as the data management institution for the Municipality, is responsible for the following work:

(I) organizing, coordinating and advancing work relating to the supply and allocation, quality assurance and security protection of public data resources throughout the Municipality;

(II) supervising, administering and guiding work relating to the processing and use of public data resources and the business operation of products throughout the Municipality;

(III) building and improving the mechanism for the authorized operation of public data resources, and organizing the formulation of policies, management systems, standards and specifications relating to the authorized operation of public data resources.

**Article 8.** The development and reform, industry and information technology, finance, market regulation, audit, taxation and other departments are responsible, within the scope of their responsibilities, for work relating to the supervision and administration of the circulation and trading of public data products and services.

**Article 9.** The cyberspace administration, public security, state security, secrecy, cryptography and other departments are responsible, within the scope of their responsibilities, for work relating to the security supervision of the authorized operation of public data resources.

## Chapter II Authorization of Public Data Resources

**Article 10.** The data management institution shall take the lead in organizing the preparation of the implementation plan for the authorized operation of public data resources. The content of the implementation plan shall comply with the relevant provisions of the *Implementation Specifications for Authorized Operation of Public Data Resources (Trial)*.

**Article 11.** The implementation plan for the authorized operation of public data resources shall, in accordance with the requirements of the "three majors and one large" (三重一大) decision-making mechanism, be submitted to the Municipal People's Government for deliberation and shall be implemented after adoption.

An implementation plan that has been examined and approved shall not, in principle, be arbitrarily changed; where a major change is genuinely required, it shall be re-submitted for deliberation and approval through the original process.

**Article 12.** The implementing institution shall, in accordance with the examined and approved implementation plan and the requirements of laws and regulations, select the operating institution through fair-competition methods such as public bidding, invited bidding or negotiation. The content of the bidding, procurement and negotiation documents relating to the authorized-operation agreement shall fully solicit the opinions of all parties.

**Article 13.** An operating institution shall satisfy the following basic conditions:

(I) sound business condition; neither the legal person nor its legal representative has been listed as a target of punishment for serious untrustworthiness, and it has no record of major administrative penalties or crimes;

(II) possession of the technical capability, professional team and office conditions required for the authorized operation of public data resources;

(III) possession of the network environment, computing-power base and security facilities that satisfy the requirement that "raw data does not leave the domain, and data is usable but not visible";

(IV) compliance with other national, provincial and municipal requirements relating to the authorized operation of public data resources.

**Article 14.** The implementing institution shall, independently or together with the relevant competent business departments at the same level, and after deliberation and approval under the implementing institution's "three majors and one large" decision-making mechanism, enter into a public-data-resource authorized-operation agreement with the operating institution selected in accordance with laws and regulations. The data management institution shall properly administer the filing of all categories of public-data-resource authorized-operation agreements in this Municipality and strengthen dynamic tracking of agreement performance. The content of the public-data-resource authorized-operation agreement shall comply with the relevant provisions of the *Implementation Specifications for Authorized Operation of Public Data Resources (Trial)*.

## Chapter III Supply of Public Data Resources

**Article 15.** The municipal government big-data platform and the municipal public-data-resource operation service platform shall be built on existing infrastructure such as the government extranet and the government cloud.

**Article 16.** Data-source institutions shall be responsible for coordinating the management and supply of public data of their unit; properly carry out the collection, verification, updating and security protection of public data; implement the requirements for the supply and allocation of public data; and ensure data quality according to the business needs of authorized-operation scenarios.

**Article 17.** The data management institution shall establish a public-data-resource registration system. Data-source institutions and operating institutions shall respectively register the public data resources, and the public data products and services, within the scope of authorized operation in accordance with the requirements for the registration administration of public data resources.

**Article 18.** Where the public data resources within the scope of authorized operation cannot satisfy the needs of a scenario, the operating institution may consolidate the relevant data requirements and request the implementing institution to coordinate and handle them.

**Article 19.** After the implementing institution, together with the data-source institution, has examined and approved the data-resource requirements and has jointly signed a public-data-resource development and utilization service agreement with the operating institution and the development institution, the data-source institution shall aggregate public data onto the municipal government big-data platform as required by the agreement; after the public data has been processed by the data-source institution or the operating institution as required by the agreement, it shall be provided to the municipal public-data-resource operation service platform.

Where public data of other regions or departments obtained through government data sharing is to be used for authorized operation, the consent of the unit that provided the shared data shall be obtained.

**Article 20.** Data-source institutions are responsible for the quality management of the public data of their unit and shall ensure the intelligibility, accuracy, standardization, consistency, completeness and timeliness of the data.

Where an operating institution or development institution discovers a public-data quality problem in the course of data processing or service provision, it shall give feedback by tracing the source level by level, and the data provider shall promptly handle the data quality problem within the scope of its responsibilities.

**Article 21.** The data management institution shall establish a mechanism for the disclosure of the state of the authorized operation of public data resources.

The implementing institution shall publicly disclose the state of authorized operation as required, regularly disclose to society the authorized parties, content, scope and time limits, and accept social supervision.

Operating institutions shall publish the list of public data products and service capabilities as required, disclose the use of public data resources, and accept social supervision.

**Article 22.** The data management institution shall, together with the finance and other relevant departments, conduct an annual evaluation of the effectiveness of public-data-resource operation for data-source institutions, and shall use it as the basis for granting data-source institutions incentives for informatization construction.

## Chapter IV Operation of Public Data Resources

**Article 23.** The operating institution shall, on the principle of "one scenario, one authorization; one scenario, one approval" (一场景一授权，一场景一审定), screen and determine development institutions to carry out data development and utilization, and shall sign scenario development and product operation agreements with them.

Operating institutions and development institutions shall use data for the scenarios stipulated in the agreement and shall not use the data for any other purpose outside the agreement.

Public data resources involving personal information or trade secrets shall be used only where the requirements of laws and regulations are satisfied and the genuine, valid and compliant authorization of the data subject has been obtained.

**Article 24.** The implementing institution shall establish and improve working systems for classification and grading, risk assessment, monitoring and early warning, and emergency handling, and shall carry out security risk assessments of the use of public data resources and compliance reviews of application business.

The implementing institution shall, together with the data-source institutions and in accordance with the classification and grading of public data and the relevant standards and specifications of each field and sector, formulate rules for the de-sensitization and encryption of public data resources, strengthen internal-control auditing of authorized-operation data, and strengthen guidance and supervision of operating institutions.

Data-source institutions shall provide public data after de-sensitization and encryption under those rules, or after processing by necessary technical means such as "usable but not visible" public data.

Operating institutions shall carry out the operation of public data resources in accordance with laws and regulations, and shall not leak, steal, tamper with, damage, lose or improperly use public data resources.

Development institutions shall develop public data products and services in accordance with laws and regulations on the basis of the municipal public-data-resource operation service platform, and shall entrust a third-party professional service institution with, or organize on their own, the compliance review of public data products and services.

**Article 25.** When operating institutions and development institutions output public data products and provide public data services externally, they shall verify the identity of the users of the public data products and services and retain records.

Operating institutions and development institutions are encouraged to establish identity-authentication mechanisms, access-control mechanisms and information audit-trail mechanisms.

**Article 26.** Public data products and services used for public governance and public welfare may be used free of charge subject to conditions.

Where commercial public data products and services used for industry development and sectoral development genuinely need to be charged for, the relevant national pricing policies shall apply.

**Article 27.** In carrying out the authorized operation of public data resources, the responsible action of cadres shall be encouraged and protected, and an atmosphere of encouraging and tolerating innovation shall be fostered, while at the same time the use of data for private gain shall be resolutely prevented.

**Article 28.** The implementing institution shall coordinate the formulation of the mechanism and indicator system for evaluating the effectiveness of the authorized operation of public data resources, and shall regularly evaluate the operating effectiveness of operating institutions. Operating institutions shall submit reports on the operation of public data resources to the implementing institution on a quarterly basis.

## Chapter V Security and Supervision

**Article 29.** Data-source institutions bear primary responsibility for data security between their unit's data-production systems and the municipal government big-data platform, and for data security across the whole process of construction, operation and maintenance of their data-production systems.

The data management institution bears primary responsibility for the data security of the municipal government big-data platform, and for data security across the whole process of construction, operation and maintenance of the municipal government big-data platform.

Operating institutions bear primary responsibility for data security between the municipal government big-data platform and the municipal public-data-resource operation service platform, and for data security across the whole process of construction, operation and maintenance of the municipal public-data-resource operation service platform.

Development institutions bear primary security responsibility for the development and business operation stages of public data products and services.

**Article 30.** The implementing institution shall, together with the cyberspace administration, public security, state security, secrecy, cryptography and other departments, establish and improve supervisory mechanisms and strengthen supervision and administration of the whole development and utilization process of public data resources, including production, processing and use, and product operation.

Operating institutions shall actively cooperate with the implementing institution in the routine supervision of the authorized operation of public data resources; define the primary security responsibilities of themselves and of development institutions; regularly conduct comprehensive risk assessments of authorized-operation activities; and regularly supervise and inspect the operational security and compliance of development institutions.

## Chapter VI Supplementary Provisions

**Article 31.** Where the people's governments of counties (county-level cities and districts) and the administrative committees of functional zones carry out activities relating to the authorized operation of public data resources in light of local needs, these Measures shall apply by reference.

The development and utilization of public data resources held by public utility enterprises in sectors such as water supply, gas supply, heating, electricity and public transportation may be authorized for use with reference to the relevant procedural requirements of these Measures, safeguarding the public interest and the lawful data rights and interests of the enterprises, and subject to supervision by the government and society.

Where the State or the Province issues new provisions on the administration of the authorized operation of public data resources, those provisions shall prevail.

**Article 32.** The Municipal Government Affairs and Data Bureau is responsible for the interpretation of these Measures.

**Article 33.** These Measures shall come into force on May 1, 2025, with a validity period of three years.