论数据处理者安全保护义务

On the Security Protection Obligation of Data Processors

摘要: 数据具有复制简便性以及传播快速性，如未在立法上设定数据处理者的安全保护义务，将带来数据安全风险。数据处理者履行数据安全风险把控能力要求、收益与风险承担原理以及企业社会责任决定了数据处理者应当承担安全保护义务。根据法律规范内容将数据处理者安全保护义务类型化为数据分类分级管理义务、数据安全技术保护义务、数据隐私保护义务。以期对学理研究和司法实践有所裨益，进而为促进我国数据安全健康发展贡献绵薄之力。

Abstract: Due to the simplicity of data replication and the rapid speed of data transmission, if the security protection obligation of the data processor is not set in the legislation, it will bring data security risks. The data processor’s performance requirements of data security risk control ability, income and risk bearing principle and corporate social responsibility determine that the data processor should assume the security protection obligation. According to the legislative content, the security protection obligation of data processors is classified into data classification management obligation, data security technology protection obligation and data privacy protection obligation. So as to be beneficial to theoretical research and judicial practice, and then contribute a small contribution to the healthy development of data security transactions in China.