China Data Protection Regulation and Enforcement
Regulators and instruments
The Cyberspace Administration of China (CAC) leads PIPL and cross-border enforcement, supported by provincial CAC offices. MIIT polices telecoms and apps, MPS handles cybersecurity crimes, SAMR handles consumer protection, and PBOC/NRTA regulate finance. Sector regulators add rules for health, education, and transport. Enforcement mixes statutes (CSL, DSL, PIPL), administrative measures, national standards, and campaigns.
Penalty regime
PIPL Article 66 has two tiers. Ordinary violations: order to correct, warning, confiscation of illegal gains, and fines up to RMB 1 million; responsible individuals up to RMB 100,000. Serious violations: fines up to RMB 50 million or 5% of previous year’s turnover, suspension of business, revocation of licenses, and bans on responsible persons, with individual fines up to RMB 1 million. Article 69 creates fault-based civil liability and public-interest litigation. Criminal liability can follow under CSL and Criminal Law provisions.
Enforcement priorities
CAC app notices target excessive permission requests, forced or bundled consent, unclear privacy notices, SDK data flows, personalized ads without opt-out, minors’ data, and face recognition. “Notification-rectification” campaigns give deadlines; failure can lead to app removal. Breach response under PIPL Article 57 requires immediate remedial measures and notification to authorities and affected individuals when harm is possible; the notice must cover data types, cause, harm, remedies, and contact. PIPL does not set a single 72-hour deadline.
Worked example
An e-commerce app requires users to accept personalized ads and shares order data with an ad SDK. CAC finds no separate consent for third-party sharing, no opt-out, and a breach exposing 300,000 users. The company had ignored a rectification notice. The conduct supports serious-tier penalties because of scale and refusal to rectify. Responsible persons can be fined and banned; users can sue with fault presumed against the company.
Traps
- Importing the GDPR 72-hour rule.
- Assuming only the company is fined; individuals can be liable.
- Treating CAC as the only regulator.
- Confusing a PIPIA with a regulatory security assessment.
- Missing DSL “important data” issues in a PI investigation.