#
China maintains an active, multi-agency enforcement apparatus with substantial recent fines, an evolving penalty ceiling (raised again via the 2025 CSL amendment), and continuous rulemaking activity through mid-2026.
Sub-modules (6)
Regulator Powers And PenaltiesGreen
Article 63 grants broad investigatory powers; a two-tier (general/grave) administrative penalty structure applies, with grave violations reaching RMB50 million or 5% of prior-year turnover plus business-suspension/license-revocation powers.
Claims (1):
- PIPL Article 63 grants supervisory authorities investigatory powers including interviews, document review, on-site inspections, and equipment seizure/confiscation; the law creates a two-tier penalty structure with general violations fined up to RMB1 million for handlers and RMB100,000 for responsible officers, and grave violations fined up to RMB50 million or 5% of the previous year's annual revenue for handlers and RMB100,000–1 million for officers, alongside rectification orders, business suspension, and license revocation powers.
Enforcement Activity IndexGreen
Landmark fines include RMB8.026 billion against Didi Global (2022) for CSL/DSL/PIPL violations and RMB50 million against academic database provider CNKI (2023) for PIPL/CSL violations.
Claims (1):
- CAC fined Didi Global approximately RMB8.026 billion in 2022 for violations of the CSL, DSL and PIPL, and separately fined academic database provider CNKI RMB50 million for PIPL and CSL violations in 2023, illustrating sustained large-scale enforcement activity.
Regulator Funding And CapacityRed
No specific data on CAC budget or headcount was located in this research pass.
Collective Redress And Class ActionsGreen
Article 70 grants standing for public-interest actions (China's equivalent of class actions) to the People's Procuratorate, statutorily designated consumer organizations, and CAC-designated organizations.
Claims (1):
- PIPL Article 70 grants standing to file public-interest actions — China's functional equivalent of class actions — to the People's Procuratorate, statutorily designated consumer organizations, and organizations designated by CAC, where a handler's infringement affects a large number of individuals.
Private Right Of ActionGreen
PIPL Article 69 shifts the burden of proof to the defendant handler once an individual demonstrates an infringement, and courts may calculate damages by reference to the handler's gains rather than only the individual's actual losses.
Claims (1):
- PIPL Article 69 shifts the burden of proof to the defendant handler once a data subject demonstrates an infringement of their personal-information rights, and courts assessing damages are not limited to actual losses but may instead rely on the gains the handler obtained from the infringing conduct.
Recent Developments 180DAmber
Within the last 180 days: the amended Cybersecurity Law (passed October 2025) raised maximum penalties and folded AI governance into CSL; a CAC directive of 28 December 2025 mandated minors'-data compliance audits and filings by 31 January 2026; and TC260 released draft amendments to the (non-binding) GB/T 35273 national standard on 17 June 2026, introducing new AI-governance and legal-basis chapters, with public comment open until 16 August 2026.
Claims (1):
- Within the 180 days preceding this run: China's amended Cybersecurity Law (passed October 2025) raised the maximum corporate fine to CNY50 million or 5% of prior-year turnover and folded AI governance into CSL's scope; a CAC directive dated 28 December 2025 required companies collecting minors' personal information to complete compliance audits and submit filings to local CAC offices by 31 January 2026; and on 17 June 2026 TC260 released draft amendments to the non-binding GB/T 35273 national standard, adding a new chapter on legal-basis guidance and AI-driven governance updates, with public comment open until 16 August 2026.
Enforcement & Redress
Enforcement exposure under China's data-protection-adjacent framework escalated on the penalty side this cycle. Commentary on the Cybersecurity Law, as amended with effect from 1 January 2026, indicates that the maximum corporate administrative fine for serious violations was raised to RMB 10 million, with penalties against individuals directly responsible reaching as high as RMB 1 million. This commentary is secondary in nature, and the primary gazette text establishing the specific cap figure was not independently retrieved this cycle, so the figure should be read as probable rather than independently verified against the primary legislative text.
Separately, a continuing programmatic enforcement effort is in progress rather than concluded: the 2026 Personal Information Protection special-action campaign, jointly run by the Cyberspace Administration of China, the Ministry of Industry and Information Technology and the Ministry of Public Security, targets illegal App and SDK collection and use of personal information, with a specific focus that includes failures to provide accessible opt-outs from personalized-recommendation advertising. This is an ongoing special-action campaign rather than a single dated enforcement action against a named entity, and no specific enforcement outcome from the campaign was identified this cycle.
Taken together, the enforcement picture this cycle is one of escalating penalty exposure under the Cybersecurity Law, paired with continuing programmatic enforcement activity targeting App and SDK practices, rather than any single high-profile dated enforcement action.
Outlook
The items to watch are whether the raised Cybersecurity Law penalty cap is applied in a dated enforcement action that would allow independent verification of the RMB 10 million figure, and whether the ongoing App/SDK special-action campaign produces named enforcement outcomes that would indicate the practical intensity of the campaign beyond its stated scope.
1 earlier distinct update(s)
Enforcement & Redress
Enforcement activity in China's data-protection landscape escalated this cycle on two fronts. First, the Cyberspace Administration of China, the Ministry of Industry and Information Technology, and the Ministry of Public Security launched a joint nationwide enforcement campaign targeting PIPL violations across six sectors on 2 April 2026. This is characterised in the evidence as marking a shift toward routine, rather than merely exemplary or high-profile, enforcement, a distinction with real significance: exemplary enforcement targets a small number of high-visibility violators to signal broader deterrence, while routine sector-wide enforcement implies sustained, ongoing compliance-checking activity across a much larger population of regulated entities.
Second, the amended Cybersecurity Law, effective 1 January 2026, raises the maximum penalty for Critical Information Infrastructure Operators to CNY 10 million where violations cause particularly serious consequences. This substantially raised penalty ceiling increases the financial stakes for Critical Information Infrastructure Operators specifically, distinguishing their exposure from that of ordinary data controllers not designated as such operators.
As standing reference context, the Cyberspace Administration of China's historical RMB 8 billion fine against Didi Global for serious violations of PIPL, the Data Security Law, and the Cybersecurity Law illustrates the outer scale of available regulatory sanction in China's enforcement landscape, even though that action predates this cycle and is not itself a new development; it remains the reference point against which the current cycle's six-sector campaign and raised CIIO penalty ceiling should be read for scale comparison.
Outlook
Watch for enforcement outcomes and any published penalty decisions arising from the 2 April 2026 six-sector campaign, which would provide the clearest evidence of whether the shift toward routine enforcement is being sustained with material financial consequences for violators. Watch also for the first application of the amended CSL's CNY 10 million penalty ceiling against a Critical Information Infrastructure Operator, which would test the raised ceiling in practice for the first time.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (5)
- ProbableIAPP — PIPL Article 63 grants supervisory authorities investigatory powers including interviews, document review, on-site inspections, and equipment seizure/confiscation; the law creates a two-tier penalty structure with general violations fined up to RMB1 million for handlers and RMB100,000 for responsible officers, and grave violations fined up to RMB50 million or 5% of the previous year's annual revenue for handlers and RMB100,000–1 million for officers, alongside rectification orders, business suspension, and license revocation powers.observed
- ProbableOneTrust DataGuidance — CAC fined Didi Global approximately RMB8.026 billion in 2022 for violations of the CSL, DSL and PIPL, and separately fined academic database provider CNKI RMB50 million for PIPL and CSL violations in 2023, illustrating sustained large-scale enforcement activity.observed
- ProbableIAPP — PIPL Article 70 grants standing to file public-interest actions — China's functional equivalent of class actions — to the People's Procuratorate, statutorily designated consumer organizations, and organizations designated by CAC, where a handler's infringement affects a large number of individuals.observed
- ProbableIAPP — PIPL Article 69 shifts the burden of proof to the defendant handler once a data subject demonstrates an infringement of their personal-information rights, and courts assessing damages are not limited to actual losses but may instead rely on the gains the handler obtained from the infringing conduct.observed
- ProbableIAPP — Within the 180 days preceding this run: China's amended Cybersecurity Law (passed October 2025) raised the maximum corporate fine to CNY50 million or 5% of prior-year turnover and folded AI governance into CSL's scope; a CAC directive dated 28 December 2025 required companies collecting minors' personal information to complete compliance audits and submit filings to local CAC offices by 31 January 2026; and on 17 June 2026 TC260 released draft amendments to the non-binding GB/T 35273 national standard, adding a new chapter on legal-basis guidance and AI-driven governance updates, with public comment open until 16 August 2026.observed