Abstract: National data security is an organic combination of national security and data security, and is an essential part of the national security system. Compared with the types of behaviors that may endanger national data security as stipulated in the Cybersecurity Law and other administrative laws, there are two problems in the current criminal law governance system: one is that the protection object is not extensive enough; the other is that the regulation of behavior is not comprehensive enough. The criminal law should respond positively in order to strengthen the protection of national data security and to connect with relevant administrative laws. Firstly, the concept of protection should be updated to protect national data security as an independent legal interest in criminal law. Secondly, expand the scope of the protection object and strengthen the protection of non-state secrets and intelligence data, establishing the crimes of stealing, spying, bribing, and unlawfully supplying important data. Thirdly, improve the types of behaviors to be regulated, to include three types of behaviors in the scope of sanctions: illegally storing important network data overseas or providing it to overseas entities, violating the national core data management system, and engaging in personal information data-processing activities that endanger national security.