--- title: "China Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/china-data-protection-privacy-regulation/ source_html: /jurisdictions/china/index.html description: "China data protection and privacy regulation: 10 categories, 74 claims, updated 2026-10-25. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: e0b28188ced4cbde7b866a61cfdeaef925192673bb6df573ab8ee4b6e90e40e7 generator: "fe-fleet/md-twin@1.0" --- # China Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # China Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/china/), [World Payments](https://payments.gi/jurisdictions/china/), artificial-intelligence Last updated 2026-10-25 · 10 categories · 74 claims · 48 sources in the cumulative register Download report (PDF) Expand all China's amended Cybersecurity Law entered into force on 1 January 2026, the first major overhaul of the statute since 2017. Data collected 2026-10-25 · Data published 2026-10-25 AI-assembled from cited sources Not fully checked this cycle: Regulator & Framework, Sectoral Watch, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-10-25 · Position last changed: 2026-10-25 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=CHINA)[Build Report](/reports/?j=CHINA)[Compare](/compare/?j=CHINA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Cyberspace Administration of China (CAC) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 9 Probable · 1 Uncertain 10 Categories 0 Red categories 57 Sub-modules 74 Claims 2 Tier-1 sources Traffic-light mix 3 green 7 amber (sums to 10 rendered categories; click to filter) No red categories; 13 sub-modules are flagged red. ## Jurisdiction brief Jurisdiction lead brief 1,285 Full executive summary 249 ###### Latest update · 25 October 2026 #### Lead Signal China's data-protection enforcement architecture moved materially on two fronts at once. The amended Cybersecurity Law, passed by the National People's Congress on 28 October 2025 and effective from 1 January 2026, substantially broadens the extraterritorial reach of Chinese enforcement authorities. Under the amendment, enforcing authorities gain the ability to launch enforcement actions and impose sanctions, including asset freezes, against any foreign institution, organisation or individual whose activities are assessed to endanger China's cybersecurity. This broadens a scope that was previously understood to be limited to attacks on critical information infrastructure, extending it to a wider category of conduct assessed as endangering cybersecurity generally. For any foreign entity operating in or around the Chinese market, this is a structural widening of jurisdictional reach rather than an incremental procedural change. In parallel, the cross-border data-transfer framework reached a point of completion. The Measures for the Certification of the Outbound Transfer of Personal Information, effective from 1 January 2026, complete what is now a three-route statutory framework under Article 38 of the Personal Information Protection Law: the Cyberspace Administration of China security assessment route, the standard contract route, and now the certification route. Organisations transferring personal information out of mainland China now have a complete, if still demanding, menu of compliance pathways to choose among, rather than a partially built framework with gaps around which no statutory mechanism existed. #### Other Developments Small-scale processors gain a simplified-measures route. The Cyberspace Administration of China and the Ministry of Public Security jointly issued the Provisions on Simplified Measures for Personal Information Protection by Small-scale Personal Information Processors on 24 July 2026, effective from 1 September 2026. This is a compliance-easing instrument targeted at smaller processors, a notable departure from the general trend of tightening obligations seen elsewhere in the framework. Fine ceilings raised under the amended Cybersecurity Law. The amendment raises the maximum fine for network operators and critical information infrastructure operators to RMB 10 million where a violation causes particularly serious consequences, alongside a parallel cap of RMB 1 million on directly responsible individuals. This sits alongside, and is distinct from, the pre-existing Personal Information Protection Law Article 66 penalty structure, which already provides for fines of up to RMB 50 million or five percent of a processor's prior-year total annual revenue for serious violations. Named enforcement action demonstrates active application of transfer-security rules. The Shanghai Cyberspace Administration of China fined a leading global online travel platform RMB 10 million under the Personal Information Protection Law for failure to implement data-export security-assessment requirements and unlawful export of personal information, among other conduct, in an action reported as occurring on 13 June 2026. This is a concrete demonstration that the cross-border transfer-security obligations established under the Personal Information Protection Law are being actively enforced against named entities, not merely maintained as a dormant statutory requirement. #### Cross-Monitor Connections The broadened extraterritorial enforcement scope under the amended Cybersecurity Law has a bearing on the territory covered by financial-integrity monitoring, to the extent that an expanded capacity to impose sanctions, including asset freezes, on foreign institutions assessed to endanger China's cybersecurity creates a parallel enforcement channel operating alongside, and potentially overlapping with, conventional financial-sanctions architecture. This connection is noted here for completeness and is not separately analysed in this brief. #### Outlook The completion of the three-route cross-border transfer framework and the now-demonstrated active enforcement of transfer-security obligations through the named June 2026 action together suggest that cross-border data transfer will remain the area of closest regulatory attention for foreign-facing businesses operating in or around mainland China. The draft Cybercrime Prevention and Control Law, whose public comment period closed on 2 March 2026, remains at the consultation stage as and had not progressed to enactment; whether it advances at a forthcoming National People's Congress Standing Committee session is the principal forward marker for the regulator-and-framework area, and its extraterritorial liability provisions for foreign providers would, if enacted, layer a further extraterritorial-reach instrument on top of the amended Cybersecurity Law. 2 earlier updates not shown here. ###### Standing brief · as of 25 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal China's amended Cybersecurity Law entered into force on 1 January 2026, the first major overhaul of the statute since 2017. The revised law extends extraterritorial liability: overseas organisations and individuals whose conduct endangers China's cybersecurity may be held legally accountable, with asset-freezing available where consequences are serious. Serious-consequence breaches, such as large-scale data leaks or the loss of critical-information-infrastructure functionality, may now draw fines of up to RMB 2 million. The Cyberspace Administration of China continues to administer and enforce the Personal Information Protection Law alongside the amended statute. #### Other Developments Beyond the headline statute, several standing and newly-operative instruments reinforce a tightening posture across controller and processor duties. The Measures for the Administration of Personal Information Protection Compliance Audits, in effect since 1 May 2025, remain operative this window. The amended Cybersecurity Law separately clarifies obligations for suppliers and purchasers of key network equipment and cybersecurity products. On cross-border data flows, the Cyberspace Administration of China and the State Administration for Market Regulation jointly issued Measures for Certification of Cross-Border Personal Information Transfer on 17 October 2025, effective 1 January 2026, completing all three transfer pathways: security assessment, standard contract, and certification. Transfers of important data remain confined to the security-assessment pathway, though transfers involving fewer than 100,000 individuals are generally exempt from the framework's stricter mechanisms. Analysts assess that completion of the three-pathway framework reduces procedural ambiguity for intra-group multinational data transfers, though it does not relax the underlying security-assessment gate that still applies to important data. A draft revision of the national standard GB/T 35273, driven by AI development and cross-border data flows, is open for public comment until 16 August 2026; as a national standard rather than binding law, it signals direction without yet imposing obligations. In the algorithmic and biometric domain, the Supreme People's Court's standing provisions on the application of law in civil cases involving facial-recognition-technology processing of personal information continue to govern private litigation in this area, with no fresh within-window instrument identified. On enforcement, the Personal Information Protection Law's ceiling for severe violations, up to CNY 50 million or 5% of the preceding year's turnover, with possible business-licence revocation, remains the operative penalty benchmark. Regulators sustained prolonged, combined online/offline special actions through 2025 targeting apps and mini-programs, SDKs, smart terminals, facial recognition, and offline consumption scenarios, alongside related criminal conduct. Violations causing damage continue to carry civil liability, with criminal liability attaching where conduct constitutes a crime under the Personal Information Protection Law, Cybersecurity Law, or Data Security Law framework. #### Cross-Monitor Connections The amended Cybersecurity Law's extraterritorial-liability clause sits alongside a broader pattern of jurisdictional assertion tracked separately on the financial-integrity monitor, where China's anti-money-laundering framework carries its own extraterritorial reach. Readers tracking that overlap should consult the financial-integrity monitor directly rather than this brief. Separately, the newly-completed cross-border transfer certification pathway may bear on on-chain personal-data flows for crypto service providers, a connection flagged for the crypto monitor. #### Outlook The most immediate marker to watch is the 16 August 2026 close of the public-comment period on the draft GB/T 35273 amendments; finalisation would formalise standard-setting language on de-identification and cross-border data flows that has so far only been proposed. More broadly, the combination of a newly in-force, extraterritorially-reaching Cybersecurity Law, a completed three-pathway cross-border transfer regime, and sustained multi-agency special-action enforcement indicates that China's data-protection and cybersecurity apparatus is consolidating rather than loosening. The core Personal Information Protection Law rights framework registered no delta this cycle, suggesting continuity there even as the surrounding cybersecurity and cross-border architecture tightens. Read full brief · 1285 words Standing brief, as of 25 August 2026. #### Regulatory Status China's amended Cybersecurity Law entered into force on 1 January 2026, the first major overhaul since 2017, extending extraterritorial liability to overseas actors and permitting asset-freezing for serious-consequence breaches, with fines of up to RMB 2 million. The Cyberspace Administration of China continues to administer and enforce the Personal Information Protection Law, whose ceiling for severe violations remains up to CNY 50 million or 5% of prior-year turnover, with possible business-licence revocation. Compliance-audit measures in effect since 1 May 2025 remain operative, and the amended Cybersecurity Law separately clarifies obligations for suppliers and purchasers of key network equipment and cybersecurity products. The Cyberspace Administration of China and the State Administration for Market Regulation completed the three-pathway cross-border transfer framework effective 1 January 2026 with new certification measures; important-data transfers remain confined to the security-assessment pathway. A draft revision of the national standard GB/T 35273 is open for public comment until 16 August 2026. Regulators sustained prolonged, combined online/offline special actions through 2025 across apps, mini-programs, SDKs, smart terminals, facial recognition and offline consumption scenarios, and the Supreme People's Court's standing civil-case provisions on facial-recognition-technology processing continue to govern private litigation. #### Outlook China's data-protection and cybersecurity architecture is tightening across the framework, controller-duty, cross-border, and enforcement dimensions simultaneously this cycle, while data subject rights, sectoral, adtech, and children's-data instruments registered no dedicated delta. The 16 August 2026 close of the GB/T 35273 comment period is the next concrete marker to watch. Read full brief · 249 words Key regulatory facts for China Regulatory Dimension China Standing Position Jurisdiction China (CN) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 74 sourced findings) Regulator & Framework A mature, enacted omnibus statute (PIPL) with implementing regulations and an active, multi-agency enforcement apparatus is in force. Lawful Processing & Special Data Lawful-basis and sensitive-data rules are enacted, detailed and actively enforced, though 'separate consent' remains only partially defined in official guidance. Data Subject Rights Substantive rights are enacted and broad, but the absence of a codified statutory response deadline creates residual ambiguity relative to GDPR-style regimes. Controller/Processor Duties Core accountability, DPIA, security and breach-notification duties are enacted and enforced, but the PIPO appointment threshold and processor ('entrusted party') definitions remain under-specified in binding text. Primary Instruments Cited IAPP, IAPP, OneTrust DataGuidance, IAPP, Legal 500 Last Confirmed / Updated 2026-10-25 (48 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### China: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ A mature, enacted omnibus statute (PIPL) with implementing regulations and an active, multi-agency enforcement apparatus is in force. Primary framework Personal Information Protection Law (PIPL, 2021) together with the Cybersecurity Law (CSL, 2017/amended 2025) and Data Security Law (DSL, 2021) Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Green A mature, enacted omnibus statute (PIPL) with implementing regulations and an active, multi-agency enforcement apparatus is in force. #### Sub-modules (5) #### Regulator And AuthorityGreen CAC is the lead/coordinating supervisory authority; MIIT, MPS, SAMR and financial regulators exercise delegated enforcement in their respective domains, unlike the single-authority models of GDPR/CPRA. Claims (3): - The PIPL confers enforcement authority jointly on multiple governmental departments — CAC, MIIT, the Ministry of Public Security, SAMR and financial regulators, plus local counterparts — with CAC taking a leading and coordinating role rather than acting as a single unified supervisory authority as under GDPR or CPRA. - China's data-protection enforcement system — CAC (general oversight and cross-border transfer approval), Ministry of Public Security (cybercrime-adjacent enforcement) and SAMR (consumer-protection-adjacent enforcement) - Cyberspace Administration of China — CAC administers and enforces the PIPL #### Act And InstrumentsGreen The CSL/DSL/PIPL triad forms the statutory core, implemented via the Network Data Security Management Regulations (eff. 1 Jan 2025) and numerous CAC secondary rules. Claims (3): - China's data governance framework rests on three national laws (CSL 2017/amended 2025, DSL 2021, PIPL 2021), implemented at national level via the Regulations on Network Data Security Management, effective 1 January 2025. - Large Personal Information Processor Provisions (draft) — Public comment opened 7 August 2026, feedback due 7 September 2026; no finalized text located as of 2026-10-11 - Cybersecurity Law (amended) — Amended CSL came into effect 1 January 2026, first major overhaul since 2017 #### Material ScopeGreen PIPL governs personal information handling activities undertaken by personal information handlers and entrusted parties (the processor-equivalent concept). Claims (1): - PIPL is China's first comprehensive data protection legislation and regulates personal information handling activities by personal information handlers and entrusted parties. #### Territorial ScopeGreen Article 3 gives PIPL extraterritorial reach, analogous to GDPR Art 3(2), covering overseas handling aimed at providing products/services to, or analyzing/assessing the behavior of, individuals in China. Claims (3): - PIPL Article 3 extends its territorial scope to the handling of personal information conducted outside China where the purpose is to provide products or services to, or to analyze/assess the behavior of, individuals located in China, or other purposes specified by law. - Cybersecurity Law of the PRC (2025 amendment) — enforcing authorities can launch enforcement actions and impose sanctions (including asset freezes) against any foreign institution, organisation or individual whose activities endanger China's cybersecurity, broadening the prior scope limited to CII attacks - Cybersecurity Law (amended) — Overseas organisations/individuals endangering China's cybersecurity may be held legally accountable, with asset-freezing for serious consequences #### Regulator Registration And FilingAmber Offshore handlers caught by Article 3 must establish a dedicated office or appoint a representative in China and report identifying details to the competent authority (Art 53). Claims (1): - Offshore personal information handlers subject to PIPL under its extraterritorial provisions must establish a dedicated office or appoint a designated representative in China for personal information protection purposes (Art 53). China's data protection regime rests on three interlocking national laws — the Cybersecurity Law (CSL, 2017, amended 2025), the Data Security Law (DSL, 2021) and the Personal Information Protection Law (PIPL, 2021, in force 1 Nov 2021) — supplemented by the Network Data Security Management Regulations (effective 1 Jan 2025). The Cyberspace Administration of China (CAC) holds the lead coordinating role but enforcement authority is shared across MIIT, the Ministry of Public Security, SAMR, financial regulators and their local counterparts. Material scope covers 'personal information handlers' and 'entrusted parties' (processor-equivalent), and the regime has explicit extraterritorial reach. Periodic update · new data 2026-10-25 #### Regulator & Framework China does not operate a single centralised data-protection authority in the manner familiar from the European model. Enforcement responsibility is distributed across the Cyberspace Administration of China, which holds general oversight and cross-border transfer approval functions; the Ministry of Public Security, which handles cybercrime-adjacent enforcement; and the State Administration for Market Regulation, which handles consumer-protection-adjacent enforcement touching personal information. This distributed structure remains the standing architecture, and no consolidation toward a single regulator was identified. The most material framework development is the amendment to the Cybersecurity Law, passed by the National People's Congress Standing Committee on 28 October 2025 and effective from 1 January 2026. The amendment substantially broadens the law's extraterritorial enforcement scope. Previously, enforcement action against foreign entities under the Cybersecurity Law was understood to be limited to attacks on critical information infrastructure located within China. The amended law extends this considerably: enforcing authorities now have the ability to launch enforcement actions and impose sanctions, including asset freezes, against any foreign institution, organisation or individual whose activities are assessed to endanger China's cybersecurity, without the conduct needing to be framed specifically as an attack on critical information infrastructure. This is a structural widening rather than a procedural adjustment. It changes the jurisdictional reach of Chinese cybersecurity enforcement from a narrowly targeted critical-infrastructure-protection tool into a broader instrument capable of reaching foreign conduct assessed, on terms set by Chinese authorities, to endanger cybersecurity in a more general sense. For foreign institutions and individuals with any nexus to China, whether through data flows, technology supply relationships, or market presence, this materially increases the population of conduct potentially within scope of Chinese enforcement action, including the asset-freeze remedy specifically. A separate, draft-stage development bears watching but had not progressed to enactment as: the draft Cybercrime Prevention and Control Law, comprising sixty-eight articles and proposing network-operator cybercrime-prevention duties, real-name enforcement requirements, and extraterritorial liability for foreign providers, had its public comment period close on 2 March 2026. As, the draft remained at the consultation stage, layered conceptually on top of the existing Cybersecurity Law, Data Security Law and Personal Information Protection Law framework, but had not been passed by the National People's Congress Standing Committee. Whether it progresses at a forthcoming Standing Committee session had not been confirmed as. No primary Cyberspace Administration of China or National People's Congress text of the amended Cybersecurity Law was independently retrieved; the amendment's scope and effective date rest on secondary legal commentary rather than the official gazetted text. #### Outlook The amended Cybersecurity Law's broadened extraterritorial scope is now in force as and represents the framework's most significant recent structural development for foreign-facing entities. The draft Cybercrime Prevention and Control Law remains the principal forward marker for this area: its extraterritorial liability provisions for foreign providers, if the draft is enacted following its closed consultation period, would add a further layer of extraterritorial reach on top of the amended Cybersecurity Law, and its progress at a forthcoming National People's Congress Standing Committee session is the development to watch. 2 earlier distinct update(s) Periodic update · new data 2026-10-12 #### Regulator & Framework China's personal information protection framework tightened for small processors and remains in active drafting for large processors this cycle. The Provisions on Simplified Measures for Personal Information Protection by Small Personal Information Processors, Order No. 25, jointly issued by the Cyberspace Administration of China and the Ministry of Public Security, was adopted at the 14th Office Meeting of 2026 of the Cyberspace Administration of China on 26 June 2026, promulgated on 22 July 2026, and entered into force on 1 September 2026. It is the first PRC departmental rule specifically addressing processors handling the personal information of fewer than 100,000 individuals, establishing a dedicated compliance track for small-scale processors rather than requiring them to meet the same obligations as larger entities. At the upper end of the processor-size spectrum, the draft Large Personal Information Processor Provisions remain at the consultation stage. Public comment opened on 7 August 2026 and the feedback window closed on 7 September 2026; the draft consolidates two earlier 2025 drafts into a single consultation text. As of 11 October 2026, no finalized version of the Provisions has been located, so the obligations it would impose on large processors remain prospective rather than binding. Taken together, these two instruments describe a regulator pursuing a tiered compliance-burden strategy: relieving small processors of heavier obligations via Order No. 25 while developing a materially more demanding regime for large processors that has not yet taken legal effect. The small-processor relief measure is now a binding, in-force instrument; the large-processor regime remains, as of this cycle, a proposal at the consultation stage, and the two should not be conflated in terms of their present legal force. #### Outlook The principal item to watch is whether the Large Personal Information Processor Provisions are finalized and promulgated, and on what timeline. Regulatory-horizon tracking places expected finalization in the fourth quarter of 2026, carrying a half-year uncertainty band given the instrument's current consultation status; this estimate should be read as provisional until a dated promulgation notice appears. Until finalization, large processors operate without the specific minimum-necessity and internal-management obligations the draft would introduce, continuing instead under the general Personal Information Protection Law baseline. Periodic update · new data 2026-09-28 #### Regulator & Framework Enforcement authority in China's data-protection landscape remains distributed across the Cyberspace Administration of China, the Ministry of Public Security and the State Administration for Market Regulation, a standing structural feature rather than a new development this cycle. What is new is the amended Cybersecurity Law, effective 1 January 2026, which is reported to constitute the most substantial amendment to the CSL since its original 2017 adoption. The amendment's most consequential feature for the regulator-and-framework module is its broadening of overseas-conduct enforcement beyond the law's former scope, which had been limited to conduct endangering critical information infrastructure. This is a genuine territorial-scope expansion, not a restatement: overseas conduct that does not touch critical information infrastructure may now fall within the amended law's enforcement reach, a materially broader jurisdictional claim than the pre-amendment framework asserted. This territorial expansion sits within a distributed-authority structure in which no single regulator holds exclusive enforcement power, meaning that the amended CSL's broadened scope will likely be operationalised through coordinated action across the three named bodies rather than through a single regulator's independent enforcement programme. The evidence base for the amendment's content and its territorial-scope implications derives from secondary legal-commentary sources rather than direct retrieval of the primary amended statutory text, a limitation that should be borne in mind when assessing the precision of the scope-expansion claim. #### Outlook Watch for primary-text confirmation of the amended CSL's exact territorial-scope language, which would allow more precise assessment of how far beyond critical-information-infrastructure conduct the new overseas-enforcement reach actually extends. Watch also for the first enforcement action under the amended law against an entity with no critical-information-infrastructure nexus, which would be the clearest practical test of the new scope. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Sources and claims (11) - [IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-4-penalties-and-enforcement-mechanisms) — The PIPL confers enforcement authority jointly on multiple governmental departments — CAC, MIIT, the Ministry of Public Security, SAMR and financial regulators, plus local counterparts — with CAC taking a leading and coordinating role rather than acting as a single unified supervisory authority as under GDPR or CPRA. - [IAPP](https://iapp.org/news/a/china-issues-the-regulations-on-network-data-security-management-what-s-important-to-know) — China's data governance framework rests on three national laws (CSL 2017/amended 2025, DSL 2021, PIPL 2021), implemented at national level via the Regulations on Network Data Security Management, effective 1 January 2025. - [OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v_pipl_.pdf) — PIPL is China's first comprehensive data protection legislation and regulates personal information handling activities by personal information handlers and entrusted parties. - [IAPP](https://iapp.org/news/a/analyzing-chinas-pipl-and-how-it-compares-to-the-eus-gdpr) — PIPL Article 3 extends its territorial scope to the handling of personal information conducted outside China where the purpose is to provide products or services to, or to analyze/assess the behavior of, individuals located in China, or other purposes specified by law. - [IAPP](https://iapp.org/news/a/analyzing-chinas-pipl-and-how-it-compares-to-the-eus-gdpr) — Offshore personal information handlers subject to PIPL under its extraterritorial provisions must establish a dedicated office or appoint a designated representative in China for personal information protection purposes (Art 53). - [Legal 500](https://www.legal500.com/intelligence/china/technology/china's-amended-cybersecurity-law-takes-effect) — Cybersecurity Law of the PRC (2025 amendment) — enforcing authorities can launch enforcement actions and impose sanctions (including asset freezes) against any foreign institution, organisation or individual whose activities endanger China's cybersecurity, broadening the prior scope limited to CII attacks - [Cyberspace Administration of China](https://www.cac.gov.cn/2026-07/24/c_1786638889704872.htm) — China's data-protection enforcement system — CAC (general oversight and cross-border transfer approval), Ministry of Public Security (cybercrime-adjacent enforcement) and SAMR (consumer-protection-adjacent enforcement) - [Cyberspace Administration of China](https://www.cac.gov.cn/2026-08/07/c_1787851071612596.htm) — Large Personal Information Processor Provisions (draft) — Public comment opened 7 August 2026, feedback due 7 September 2026; no finalized text located as of 2026-10-11 - [Mayer Brown](https://www.mayerbrown.com/en/insights/publications/2025/12/china-finalises-amendments-to-the-cybersecurity-law-what-businesses-need-to-know-before-1-january-2026) — Cybersecurity Law (amended) — Amended CSL came into effect 1 January 2026, first major overhaul since 2017 - [Office of the Privacy Commissioner for Personal Data, Hong Kong](https://www.pcpd.org.hk/english/data_privacy_law/mainland_law/mainland_law.html) — Cyberspace Administration of China — CAC administers and enforces the PIPL - [Chambers and Partners](https://practiceguides.chambers.com/practice-guides/data-protection-privacy-2026/china/trends-and-developments) — Cybersecurity Law (amended) — Overseas organisations/individuals endangering China's cybersecurity may be held legally accountable, with asset-freezing for serious consequences ### China: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Lawful-basis and sensitive-data rules are enacted, detailed and actively enforced, though 'separate consent' remains only partially defined in official guidance. Primary framework PIPL Chapter II, Arts 13–30; GB/T 35273 (Personal Information Security Specification, amendments proposed June 2026) Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Green Lawful-basis and sensitive-data rules are enacted, detailed and actively enforced, though 'separate consent' remains only partially defined in official guidance. Periodic update · new data 2026-10-25 #### Lawful Processing & Special Data A new compliance-easing instrument for smaller data processors was issued, a notable counterpoint to the general tightening trend seen elsewhere in China's data-protection framework. The Cyberspace Administration of China and the Ministry of Public Security jointly issued the Provisions on Simplified Measures for Personal Information Protection by Small-scale Personal Information Processors on 24 July 2026, with the instrument taking effect from 1 September 2026. The instrument addresses a gap that had existed in the standing Personal Information Protection Law framework, under which consent thresholds, impact-assessment obligations, and other lawful-processing duties had applied without meaningful differentiation by processor size. Small-scale processors, which may lack the compliance infrastructure of larger platform operators or critical-information-infrastructure operators, now have a simplified route available to them for meeting personal-information-protection obligations. The specific simplified-measures provisions themselves, in terms of which consent-threshold or special-category-data obligations are eased and by how much, were not independently detailed in the material available beyond confirmation of the instrument's issuance and effective date. This development should be read in the context of China's broader lawful-processing architecture, which remains otherwise unchanged: core consent requirements, the treatment of sensitive personal information, and special-category-data handling rules under the Personal Information Protection Law continue to apply as previously established, with no amendment to those core provisions identified. The simplified-measures instrument operates as a scope-narrowing carve-out for a defined category of smaller processors rather than as a change to the underlying lawful-processing standard itself. No primary Cyberspace Administration of China gazette text setting out the full detail of the simplified measures was independently retrieved; the instrument's existence, joint-issuing authorities, and effective date rest on secondary legal commentary. #### Outlook The simplified-measures instrument for small-scale processors takes effect from 1 September 2026 and had, as at this point, not yet been in force long enough for any enforcement or compliance-uptake data to be available. The development to watch is whether subsequent guidance clarifies the specific quantitative or qualitative thresholds that define a small-scale processor for purposes of eligibility, and whether the simplified measures extend to any special-category-data processing or remain confined to general consent and procedural obligations. D2 · Lawful Processing — Full Module Record 4 sub-modules · 90 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### China: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Uncertain▾ Substantive rights are enacted and broad, but the absence of a codified statutory response deadline creates residual ambiguity relative to GDPR-style regimes. Primary framework PIPL Chapter IV, Arts 44–50 Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Amber Substantive rights are enacted and broad, but the absence of a codified statutory response deadline creates residual ambiguity relative to GDPR-style regimes. #### Sub-modules (5) #### Access RightGreen Individuals have the right to access and obtain copies of their personal information, which handlers must provide in a timely fashion. Claims (1): - Under PIPL, individuals have the right to access and make copies of their personal information, and personal information handlers must provide such information in a timely fashion. #### Rectification And ErasureGreen Individuals may request correction, supplementation or updating of inaccurate/incomplete/outdated personal information, and may request deletion. Claims (1): - Individuals are entitled to correct, supplement and update incomplete, inaccurate or outdated personal information and may request deletion of their personal information from handlers. #### Restriction And ObjectionGreen Individuals may demand an explanation of automated-decision-making use and may refute decisions made solely via automated means where those decisions significantly affect them. Claims (1): - Data subjects have the right to request an explanation regarding the use of their personal information and to refute a decision made by a handler solely through automated decision-making where it significantly affects them. #### Data PortabilityGreen PIPL provides a portability right allowing individuals to request transfer of their personal information to another handler; PIPL goes further than GDPR by permitting legal claims against handlers who reject rights requests. Claims (1): - PIPL provides a right of portability whereby individuals may request that a personal information handler transfer their personal information to another handler; PIPL exceeds GDPR by granting individuals a right to bring claims against handlers who reject a rights request and a right to demand an explanation of handling rules. #### Deadlines And Response WindowsAmber PIPL requires handlers to respond to access requests 'in a timely fashion' but does not set a fixed statutory day-count deadline analogous to GDPR's one-month rule; no secondary source located specifying a harmonized numeric window across all right types. Claims (1): - PIPL requires personal information handlers to respond to access requests 'in a timely fashion' rather than specifying a codified numeric response deadline equivalent to GDPR's one-month rule. PIPL Chapter IV grants a GDPR-adjacent rights bundle: access/copy, rectification, erasure, restriction/objection (including a right to demand explanation of and refute automated decisions), and a portability right that in some respects exceeds GDPR by allowing individuals to sue handlers who refuse rights requests and by extending exercise of rights to close relatives of deceased individuals. However, PIPL does not codify a fixed numeric response-deadline analogous to GDPR's one-month rule; the statute only requires handlers to respond 'in a timely fashion,' leaving specific windows to sectoral/CAC guidance. Sources and claims (5) - [IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — Under PIPL, individuals have the right to access and make copies of their personal information, and personal information handlers must provide such information in a timely fashion. - [IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — Individuals are entitled to correct, supplement and update incomplete, inaccurate or outdated personal information and may request deletion of their personal information from handlers. - [IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — Data subjects have the right to request an explanation regarding the use of their personal information and to refute a decision made by a handler solely through automated decision-making where it significantly affects them. - [IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — PIPL provides a right of portability whereby individuals may request that a personal information handler transfer their personal information to another handler; PIPL exceeds GDPR by granting individuals a right to bring claims against handlers who reject a rights request and a right to demand an explanation of handling rules. - [IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-2-obligations-and-rights) — PIPL requires personal information handlers to respond to access requests 'in a timely fashion' rather than specifying a codified numeric response deadline equivalent to GDPR's one-month rule. ### China: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core accountability, DPIA, security and breach-notification duties are enacted and enforced, but the PIPO appointment threshold and processor ('entrusted party') definitions remain under-specified in binding text. Primary framework PIPL Chapter V (Arts 51–59); Regulations on Network Data Security Management (eff. 1 Jan 2025) Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Amber Core accountability, DPIA, security and breach-notification duties are enacted and enforced, but the PIPO appointment threshold and processor ('entrusted party') definitions remain under-specified in binding text. Periodic update · new data 2026-10-12 #### Controller/Processor Duties Control and processor obligations in China are now visibly tiered by processor scale. For small personal information processors, those handling the personal information of fewer than 100,000 individuals, Order No. 25 establishes two operative relief measures now in force since 1 September 2026. Under Article 13, a small processor may conduct a compliance audit at least once every five years, using a simplified self-check form, the Small Personal Information Processor Compliance Audit Self-Check Form, annexed to the Provisions, and must retain the resulting audit records; this stands in place of the more frequent or more rigorous audit obligations that would otherwise apply. Under Article 12, a small processor that ceases its product or service must take necessary measures to delete the personal information it holds; where it is genuinely unable to delete that information, it may instead report the situation to the relevant competent department and request assistance, rather than being left with an unconditional deletion obligation it cannot practically meet. At the other end of the scale, the draft Large Personal Information Processor Provisions would impose a materially heavier set of duties once finalized. Article 9 of the draft requires a qualifying large processor's collection of personal information to adhere to the minimum-necessity principle, limiting collection to what is necessary to provide the product or service and prohibiting over-collection. This provision remains at the consultation stage, with the comment window having closed on 7 September 2026, and is not yet binding; it nonetheless signals the direction of the large-processor compliance architecture the regulator is developing, which the regulatory horizon tracking anticipates would additionally include internal management systems and proactive security-monitoring duties once the instrument is finalized. The practical effect of this tiering is to create two distinct compliance postures within the same statutory framework: a now-binding, simplified obligations track for small processors, and a prospective, substantially heavier obligations track for large processors that remains in active drafting. A processor's classification into one tier or the other will materially determine its present and near-future compliance burden. #### Outlook The principal development to watch is whether the draft large-processor obligations, particularly the Article 9 minimum-necessity requirement, are finalized in the form consulted upon or are revised before promulgation. Given the consultation closed on 7 September 2026 and no finalized text had appeared as of 11 October 2026, the fourth-quarter-2026 finalization estimate carries meaningful uncertainty, and large processors should not assume the consultation-stage text is final. D4 · Controller & Processor — Full Module Record 7 sub-modules · 100 words · 11 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### China: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Transfer mechanisms are well-established and increasingly detailed, but thresholds have shifted multiple times since 2022 and important-data classification remains only partially settled, creating ongoing compliance uncertainty. Primary framework PIPL Chapter III (Arts 38–43); Measures for Security Assessment of Outbound Data Transfers (2022); Chinese SCC Provisions (2023); Provisions on Promoting and Regulating Cross-Border Data Flows (2024) Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Amber Transfer mechanisms are well-established and increasingly detailed, but thresholds have shifted multiple times since 2022 and important-data classification remains only partially settled, creating ongoing compliance uncertainty. Periodic update · new data 2026-10-25 #### Cross-Border & Adequacy China's cross-border personal-information transfer framework reached completion with the entry into force of the Measures for the Certification of the Outbound Transfer of Personal Information, effective from 1 January 2026. This instrument supplies the third of three statutory transfer routes available under Article 38 of the Personal Information Protection Law, alongside the pre-existing Cyberspace Administration of China security-assessment route and the standard-contract route. Organisations transferring personal information out of mainland China now have a complete menu of three distinct statutory pathways to choose among, rather than a framework with an unaddressed gap for organisations unable or unwilling to use either of the first two routes. The security-assessment route itself remains reserved for the more demanding category of transfers: it is required for transfers involving what is termed important data, or for transfers of personal information exceeding one million individuals. This threshold-based triggering mechanism for the most stringent route remains unchanged and continues to function as the gatekeeping mechanism determining which transfers must undergo the fuller assessment rather than relying on the standard contract or certification routes. Separately, Article 40 of the Personal Information Protection Law continues to impose domestic-storage duties on critical-information-infrastructure operators and on personal-information handlers meeting a Cyberspace-Administration-of-China-set quantity threshold, subject to an assessment route for necessary exports. This data-localisation provision is a standing feature of the framework and was not amended; it operates alongside, rather than in place of, the three transfer routes, since localisation obligations determine whether data may leave China at all before the transfer-route question arises. For transfers that do proceed, the framework additionally requires a pre-transfer personal-information protection impact assessment and the retention of records of the processing, with the assessment report and processing records required to be retained for at least three years. These procedural requirements apply across the transfer routes and were not altered. The practical significance of the certification route's completion is that it gives organisations, particularly multinational corporate groups transferring personal information within a single corporate structure, a route that does not require case-by-case government security assessment or the execution of a bilateral standard contract with each receiving party, provided the organisation can meet the certification scheme's requirements. No primary Cyberspace Administration of China text detailing the certification scheme's specific application procedure was independently retrieved. #### Outlook With all three statutory transfer routes now in force as at 1 January 2026, the cross-border framework has moved from a partially built structure to a complete one, and the area of closest attention going forward shifts from framework-completion questions to enforcement-application questions: how actively the Cyberspace Administration of China applies the security-assessment and certification routes' thresholds in practice, and whether further guidance clarifies the boundary between the three routes for organisations with mixed transfer profiles. Periodic update · new data 2026-09-28 #### Cross-Border & Adequacy China's cross-border personal information transfer framework reached structural completion this cycle. The Measures for Certification of Cross-Border Personal Information Transfer, effective 1 January 2026, complete the three-pathway framework under PIPL: security assessment, standard contract, and certification. This is a confirmed, materially significant development: prior to this measure, the certification pathway existed in name but lacked the operational detail now supplied, and the framework's completion gives data controllers a genuine choice among three distinct compliance routes rather than a binary choice between the two previously-operational pathways. From the same 1 January 2026 effective date, data controllers otherwise required to use China's Standard Contractual Clauses now have the option of obtaining certification instead, introducing a new compliance-pathway optionality that did not previously exist in practice. This is probably significant for multinational data controllers who had defaulted to the Standard Contractual Clauses route in the absence of an operational certification alternative, and who may now find certification a more suitable pathway depending on their specific transfer profile and volume. A further requirement reported this cycle, though on weaker single-source evidence, holds that every PIPL cross-border transfer requires a current Personal Information Protection Impact Assessment on file. This claim rests on uncorroborated secondary compliance guidance rather than independently verified primary-source confirmation, so it should be read as an unconfirmed compliance expectation rather than a settled requirement pending further verification. Separately, the precise current volume thresholds distinguishing which of the three pathways applies to a given transfer were reported inconsistently across secondary sources this cycle and were not verified against the primary Cyberspace Administration of China measures text directly, a gap that limits the precision with which controllers can currently map their own transfer volumes to the correct compliance pathway. #### Outlook Watch for primary-source verification of the current cross-border transfer volume thresholds governing pathway selection, and for whether the reported PIPIA-for-every-transfer requirement is corroborated by additional independent sourcing or clarified as a narrower requirement applying only to certain transfer categories. The completion of the three-pathway framework itself is not expected to change further in the near term absent a fresh regulatory intervention. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 98 words · 11 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### China: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Financial-sector and employment-data overlays are documented, but health, education and insurance sector-specific DP overlays were not located in this pass and are flagged as a research gap. Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Amber Financial-sector and employment-data overlays are documented, but health, education and insurance sector-specific DP overlays were not located in this pass and are flagged as a research gap. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 107 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### China: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Algorithm-transparency and anti-price-discrimination rules are enacted and enforced, but cookie-consent, opt-out-signal and clean-room-specific regimes are absent from China's framework. Primary framework Provisions on the Management of Algorithmic Recommendations in Internet Information Services (2022); PIPL Art 24 Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Amber Algorithm-transparency and anti-price-discrimination rules are enacted and enforced, but cookie-consent, opt-out-signal and clean-room-specific regimes are absent from China's framework. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 65 words · 3 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### China: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ AI- and biometric-specific rules are extensive and rapidly evolving (including a 2025 CSL amendment), but genetic-data specificity is absent and state-surveillance carve-outs remain structurally unconstrained by PIPL's private-sector-facing rules. Primary framework PIPL Art 24; Provisions on Algorithmic Recommendations (2022); Provisions on Deep Synthesis (2023); Interim Measures for Generative AI Services (2023); amended Cybersecurity Law (2025) Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Amber AI- and biometric-specific rules are extensive and rapidly evolving (including a 2025 CSL amendment), but genetic-data specificity is absent and state-surveillance carve-outs remain structurally unconstrained by PIPL's private-sector-facing rules. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 153 words · 6 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### China: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Minors' data receives clear sensitive-category and parental-consent treatment with active 2025-2026 filing enforcement, but dependent-adult protections and minor-specific profiling bans were not located in this research pass. Primary framework Provisions on Cyber Protection of Children's Personal Information (2019); PIPL Art 28 Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Amber Minors' data receives clear sensitive-category and parental-consent treatment with active 2025-2026 filing enforcement, but dependent-adult protections and minor-specific profiling bans were not located in this research pass. D9 · Children's Privacy — Full Module Record 5 sub-modules · 96 words · 2 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### China: D10 Enforcement & Redress6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ China maintains an active, multi-agency enforcement apparatus with substantial recent fines, an evolving penalty ceiling (raised again via the 2025 CSL amendment), and continuous rulemaking activity through mid-2026. Primary framework PIPL Chapter VII (Arts 60–71); amended Cybersecurity Law (2025) Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Green China maintains an active, multi-agency enforcement apparatus with substantial recent fines, an evolving penalty ceiling (raised again via the 2025 CSL amendment), and continuous rulemaking activity through mid-2026. Periodic update · new data 2026-10-25 #### Enforcement & Redress China's enforcement posture under its data-protection framework escalated materially across both the penalty-ceiling and enforcement-activity dimensions. The amended Cybersecurity Law, effective from 1 January 2026, raised the maximum fine for network operators and critical information infrastructure operators to RMB 10 million where a violation causes particularly serious consequences, with a parallel cap of RMB 1 million on directly responsible individuals. This fine increase operates alongside, and is distinct from, the pre-existing Personal Information Protection Law Article 66 penalty structure, which already provides for fines of up to RMB 50 million or five percent of a processor's prior-year total annual revenue for serious violations, with a parallel individual fine of up to RMB 1 million. The two penalty regimes address overlapping but formally separate statutory bases, with the Cybersecurity Law provision applying to network operators and critical-information-infrastructure operators specifically and the Personal Information Protection Law provision applying more broadly to personal-information processors. The standing Personal Information Protection Law Article 54 obligation requiring data controllers to conduct regular compliance audits of their personal-information handling continues to apply unchanged and provides a procedural backdrop against which the raised penalty ceilings operate; an organisation's compliance-audit record is relevant to how enforcement authorities assess the severity of a violation once a penalty determination is being made. Demonstrating that these raised ceilings are not merely theoretical, the Shanghai Cyberspace Administration of China fined a leading global online travel platform RMB 10 million under the Personal Information Protection Law, in an action reported as occurring on 13 June 2026. The stated basis for the fine was failure to implement the requirements for data-export security assessment and unlawful export of personal information, among other conduct. This action sits squarely within the cross-border transfer-security territory addressed by Personal Information Protection Law Article 66(2), and its size, at the RMB 10 million level, demonstrates that Chinese enforcement authorities are prepared to impose penalties at a materially significant level against major commercial platforms for cross-border transfer violations specifically, rather than reserving significant penalties for a narrower category of egregious data-security breaches. A further enforcement thread, running alongside but distinct from the named platform action, involves continuing Cyberspace Administration of China public-notice activity addressing personal-information-collection violations across a batch of mobile applications, including findings that certain applications failed to provide effective account-cancellation channels or imposed unreasonable conditions on users seeking to delete their accounts. This reflects continuing attention to app-level consumer-facing compliance failures as a distinct enforcement thread from the larger-scale cross-border transfer action. No primary Shanghai Cyberspace Administration of China enforcement notice or official penalty decision document for the named platform action was independently retrieved; the action's existence, amount, and stated basis rest on secondary legal commentary. #### Outlook With both the Cybersecurity Law fine ceiling increase and a named RMB 10 million Personal Information Protection Law enforcement action now in effect and on the public record respectively as, the enforcement trajectory for cross-border transfer violations in particular appears to be escalating rather than stable. The development to watch going forward is whether further enforcement actions at a comparable or greater scale follow against other commercial platforms, which would confirm the June 2026 action as the start of a pattern rather than an isolated case. Periodic update · new data 2026-10-12 #### Enforcement & Redress Enforcement exposure under China's data-protection-adjacent framework escalated on the penalty side this cycle. Commentary on the Cybersecurity Law, as amended with effect from 1 January 2026, indicates that the maximum corporate administrative fine for serious violations was raised to RMB 10 million, with penalties against individuals directly responsible reaching as high as RMB 1 million. This commentary is secondary in nature, and the primary gazette text establishing the specific cap figure was not independently retrieved this cycle, so the figure should be read as probable rather than independently verified against the primary legislative text. Separately, a continuing programmatic enforcement effort is in progress rather than concluded: the 2026 Personal Information Protection special-action campaign, jointly run by the Cyberspace Administration of China, the Ministry of Industry and Information Technology and the Ministry of Public Security, targets illegal App and SDK collection and use of personal information, with a specific focus that includes failures to provide accessible opt-outs from personalized-recommendation advertising. This is an ongoing special-action campaign rather than a single dated enforcement action against a named entity, and no specific enforcement outcome from the campaign was identified this cycle. Taken together, the enforcement picture this cycle is one of escalating penalty exposure under the Cybersecurity Law, paired with continuing programmatic enforcement activity targeting App and SDK practices, rather than any single high-profile dated enforcement action. #### Outlook The items to watch are whether the raised Cybersecurity Law penalty cap is applied in a dated enforcement action that would allow independent verification of the RMB 10 million figure, and whether the ongoing App/SDK special-action campaign produces named enforcement outcomes that would indicate the practical intensity of the campaign beyond its stated scope. Periodic update · new data 2026-09-28 #### Enforcement & Redress Enforcement activity in China's data-protection landscape escalated this cycle on two fronts. First, the Cyberspace Administration of China, the Ministry of Industry and Information Technology, and the Ministry of Public Security launched a joint nationwide enforcement campaign targeting PIPL violations across six sectors on 2 April 2026. This is characterised in the evidence as marking a shift toward routine, rather than merely exemplary or high-profile, enforcement, a distinction with real significance: exemplary enforcement targets a small number of high-visibility violators to signal broader deterrence, while routine sector-wide enforcement implies sustained, ongoing compliance-checking activity across a much larger population of regulated entities. Second, the amended Cybersecurity Law, effective 1 January 2026, raises the maximum penalty for Critical Information Infrastructure Operators to CNY 10 million where violations cause particularly serious consequences. This substantially raised penalty ceiling increases the financial stakes for Critical Information Infrastructure Operators specifically, distinguishing their exposure from that of ordinary data controllers not designated as such operators. As standing reference context, the Cyberspace Administration of China's historical RMB 8 billion fine against Didi Global for serious violations of PIPL, the Data Security Law, and the Cybersecurity Law illustrates the outer scale of available regulatory sanction in China's enforcement landscape, even though that action predates this cycle and is not itself a new development; it remains the reference point against which the current cycle's six-sector campaign and raised CIIO penalty ceiling should be read for scale comparison. #### Outlook Watch for enforcement outcomes and any published penalty decisions arising from the 2 April 2026 six-sector campaign, which would provide the clearest evidence of whether the shift toward routine enforcement is being sustained with material financial consequences for violators. Watch also for the first application of the amended CSL's CNY 10 million penalty ceiling against a Critical Information Infrastructure Operator, which would test the raised ceiling in practice for the first time. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 189 words · 13 traced claims · Re-verified 2026-10-25 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (37 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) data localisation Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer impact assessment Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties