GB/T 37932-2025Data security technology - Security requirements for data transaction services (English PDF)

4.1 Reference model for data transaction services

Data transaction services are categorized into two models. data in-site transaction and data off-site transaction. Data in-site transaction involves suppliers and demanders transacting through a data transaction agency, whereas data off-site transaction takes place outside of such agencies. In actual practice, transactions may take place directly between data suppliers and demanders or through data transaction institutions. Data providers may also participate in the process, providing services such as the development, release, and underwriting of data products and services. Additionally, specialized data third-party professional service agencies may offer legal support, data assetization, security and quality assessments, and training and consulting to facilitate the orderly conduct of data transaction activities. A reference model for data transaction services is shown in Figure 1.

4.2 Data transaction process

The end-to-end process of data in-site transaction typically encompasses stages such as entity onboarding, registration and listing, transaction negotiation, order execution, product delivery, settlement, transaction conclusion, and supervision and maintenance.

Among these, entity onboarding and registration/listing constitute the pre-transaction preparation phase; transaction negotiation, order execution, product delivery, and settlement constitute the execution phase; and transaction conclusion and supervision/maintenance constitute the post-transaction phase. The process of data off-site transaction typically includes stages such as transaction negotiation, order execution, product delivery, settlement, and transaction conclusion. Apart from data transaction agencies, other participants in data transaction must comply with the relevant security requirements set forth in Chapter 9. The data transaction process comprises the following aspects.

a) Entity onboarding. data suppliers, data demanders, providers, and data third-party professional service agencies register with the data transaction institution, completing steps such as user registration, real-name authentication, qualification review, and profile completion.

b) Registration and listing. information regarding the data transaction object is registered, and assessments and reviews are conducted concerning the compliance and quality of data products and services. Data products and services that pass this review are then listed on the data transaction agency.

NOTE 1: The assessment and review are conducted by data transaction agencies or professional data third-party professional service agencies.

c) Transaction negotiation. once the parties to the transaction have connected, they negotiate terms such as the intended use of the subject matter, transaction amount, delivery method, and security responsibilities. The demander may also request data products and services or sample data for testing. Shall further processing of the data products and services be required, the demander may issue a request for such processing to be performed by the data supplier or data provider.

d) Order execution. the data demander selects data products and services and places an order. After the supplier confirms the order details, both parties sign a data transaction contract, and the data transaction agency reviews and files the contract.

e) Product delivery. data products and services are delivered in accordance with the terms of the data transaction contract - whether via a data transaction platform, through a data provider, or through direct delivery between the parties - and the data demander conducts an acceptance review of the delivered products and services.

f) Settlement. settle fees for transaction participants based on the terms of data transaction contracts and payment bills, and support refunds for fees associated with excess purchases.

g) Transaction conclusion. conclude the data transaction, record and archive transaction-related information, conduct audits, and provide after-sales service for the data transaction.

h) Supervision and maintenance. establish mechanisms for handling complaints, reports, and dispute resolution regarding data transactions. Address issues arising from such transactions. Support the review and traceability of illegal or non-compliant data transaction activities, and safeguard the rights and interests of transaction participants.

NOTE 2: Transaction disputes shall primarily be handled by the data transaction agency. If a resolution cannot be reached through coordination, the matter may be referred to expert arbitration or external arbitration bodies.

4.3 Data transaction object

The data transaction object typically involves data products and services such as datasets, data interfaces, data reports, data applications, data tools, data services, and other data-related items.

a) Datasets. a collection of data or a data file that centers on a specific theme and meets user needs.

b) Data interfaces. data accessed via Application Programming Interfaces (APIs) or Software Development Kits (SDKs), such as data verification interfaces and data query interfaces.

c) Data reports. a report presenting the results of data processing - such as statistical analysis and modeling - through visualizations like text and charts.

d) Data applications. data application services or customized solutions provided after data resources have been processed;

e) Data tools. tools providing data processing capabilities such as data acquisition, storage, transmission, preprocessing, processing, visualization, and deletion;

f) Data services. in the process of data transaction, data services - such as data collection, data processing, and security assessment services - are provided by data providers and specialized data third-party professional service agencies.

g) Other data-related items. other data products and services tradable in accordance with the law, such as application accounts, algorithm models, data indices, and encrypted data.