Personal data security and stock crash risk : evidence from China's cybersecurity law

Using China's Cybersecurity Law (CSL) as an exogenous shock, I examine how personal data security affects stock crash risk. I find that the stock crash risk of treatment firms (which collect personal data) significantly decreases after the CSL, and such decrease is larger when firms face greater personal data breach risk and have less transparent information environments before the CSL. Furthermore, treatment firms increase their investment in personal data protection after the CSL. Finally, enhanced personal data security increases firm value and promotes firms' social responsibility to stakeholders. Overall, I provide evidence of the importance of data security for the digital economy from the perspective of capital market stability, which may present implications for data security policy worldwide.