Clearer skies for foreign cloud services in China?

China’s complex and restrictive regulatory framework governing data protection, cybersecurity and internet services has made accessing its vast cloud computing market a highly complicated process.

Global IT companies shifting their business models to focus on the cloud have found it particularly tough to navigate—and enter—the domestic market, and the nation’s IT regulator has drafted new rules to clarify the applicable scope of cloud services, the required licenses and qualifications, and the extent to which foreign operators can actually get involved.

These have been put forward in the Circular on Standardizing Business Conducts in Cloud Services Market (Draft for Comments) (Circular), published on November 24, 2016 by the Information Communication Administration of the Ministry of Industry and Information Technology (MIIT). It is soliciting public opinions by December 24, 2016.

If adopted, the Circular will be the first MIIT regulation specific to cloud computing services, and will provide significant guidance to an industry projected by Bain & Company to be worth $20 billion by 2020 and grow 40% every year. The PRC government already views cloud computing as a strategic priority, and China’s tech giants Tencent and Alibaba are leading this charge in the private sector, with each announcing last year to invest $1.6 billion and $1 billion into its own cloud business unit, respectively.

Cloud services defined

The Circular categorizes “cloud services” as “internet resources collaborative services” (IRCS), a subset of internet data center (IDC) services listed in the Classified Catalogue of Telecommunications Services (Telecom Catalogue).

Article 1 of the Circular presents a clearer legal definition of “cloud services”, though with a narrower scope compared with international standards and industry practice. It has been generally recognized that IRCS under the Telecom Catalogue includes PaaS [Platform as a Service] and parts of IaaS [Infrastructure as a Service], while excluding most SaaS [Software as a Service]. In other words, IRCS under the Telecom Catalogue does not cover all—if not most—operational models of cloud services. (According to the Telecom Catalogue, IRCS refers to data storage services, internet applications development, internet applications deployment services, and operation management services provided in a way of “real-time, on-demand usage, expandable and real-time collaboration and sharing” through the internet or other networks, based on equipment and resources of data centers.)

The Circular’s clarification of “cloud services” may therefore serve more as a demonstrative regulatory scope rather than an ultimate official definition.

Qualification requirements

The Circular stresses that cloud service providers must meet all the relevant requirements for capital, personnel, site and facilities set out in the Measures for the Administration of Telecommunications Business Operation Permits (Telecom Permit Measures) and the Circular on Further Standardizing Market Access-related Work for Businesses Concerning Internet Data Centers and Internet Service Providers. They must also pass relevant technical assessments and obtain the corresponding value-added telecom business permits.