← مقالات وأدلة عن الاحتيال والأمن السيبراني والخصوصية

China's data protection regime: PIPL, DSL and the 2025–2026 changes

A guide to China's PIPL, Data Security Law and cross-border data rules, with what changed in 2025–2026, including audits, certification and the amended CSL.

2026-10-14

China's data rules are built on three laws: the Cybersecurity Law (CSL, in force since 2017), the Data Security Law (DSL, since September 2021) and the Personal Information Protection Law (PIPL, since November 2021). Over 2025 and 2026, regulators filled in the details with implementing regulations, audit rules, a new certification route for data exports and a tougher, amended CSL. For any company handling data of people in China, the framework is now both more workable and more enforceable.

The three pillars

Law	Focus
Cybersecurity Law (2017; amended, in force Jan 1, 2026)	Network security, critical information infrastructure (CII), multi-level protection scheme
Data Security Law (2021)	Data classification, "important data" and "core data", national security
PIPL (2021)	Personal information: consent, individual rights, cross-border transfers

Under PIPL Article 66, serious violations can draw fines of up to RMB 50 million or 5% of the prior year's turnover, plus fines on responsible individuals.

Cross-border transfers: the current map

PIPL offers three routes for exporting personal information: a CAC security assessment, a standard contract filed with the CAC, or certification by an approved body. The March 22, 2024 Provisions on Promoting and Regulating Cross-Border Data Flows set thresholds and exemptions, as summarized by WilmerHale:

Situation (non-CII operator, counted since Jan 1 of the year)	Requirement
Important data, or any export by a CII operator	Security assessment
Non-sensitive PI of more than 1 million people, or sensitive PI of more than 10,000	Security assessment
Non-sensitive PI of 100,000 to 1 million, or sensitive PI below 10,000	Standard contract or certification
Non-sensitive PI of fewer than 100,000	Exempt

Exemptions also cover data needed to perform a contract with the individual (such as cross-border shopping or visa applications) and cross-border HR management. Pilot free trade zones can publish "negative lists" that free other data from the formal routes.

What changed in 2025–2026

Network Data Security Management Regulations (Jan 1, 2025)

Issued by the State Council in September 2024, these regulations apply to foreign entities that offer products or services to people in China or analyze their behavior. They require processors of important data, or of personal information of more than 10 million people, to appoint a data security lead and a management body, keep processing records for at least three years and notify affected parties of incidents.

Personal information compliance audits (May 1, 2025)

The CAC's audit measures require processors handling data of more than 10 million people to audit compliance at least every two years. Those handling more than 1 million must designate a personal information protection officer and file with the provincial CAC.

Certification route finalized (Jan 1, 2026)

On October 14, 2025, the CAC and SAMR issued measures on certification for cross-border personal information transfers, completing the third PIPL route for mid-volume exporters.

Amended Cybersecurity Law (Jan 1, 2026)

Passed by the NPC Standing Committee on October 28, 2025, the amendments mainly raise liability:

The maximum fine for general violations by entities rises from RMB 100,000 to RMB 500,000; for severe cases, up to RMB 10 million. Individuals face up to RMB 1 million.
Penalties can apply to the violation itself, without proof of "serious consequences".
Extraterritorial reach extends to any overseas activity that endangers China's cybersecurity, with possible asset freezes for serious cases.
Network operators must follow the Civil Code and PIPL when processing personal information, harmonizing the three laws.
A new article commits the state to AI ethics norms and AI risk monitoring.

Standards

GB/T 45574-2025 on sensitive personal information took effect November 1, 2025, and GB/T 46068-2025 on cross-border processing on March 1, 2026. Both are recommended standards, but Arnold & Porter notes they are often used as benchmarks in enforcement.

Penalties in the amended CSL, by article

Bird & Bird lists the new ranges for companies: Article 61 (general security obligations) rises to RMB 50,000–500,000; Article 65 (certification, testing, risk assessment and disclosure) to RMB 100,000–1 million; Article 69 (illegal information) to RMB 500,000–2 million. Supply chain violations involving uncertified network equipment carry fines tied to illegal gains. Serious cases can lead to business suspension or license revocation. At the same time, the law imports Administrative Penalty Law provisions allowing lighter or waived penalties for cooperation or minor first-time violations.

Enforcement: the Dior case

In 2025, Shanghai public security authorities penalized Dior's local subsidiary under the PIPL after investigating a data breach discovered in May. According to CMS, investigators found that customer data had been sent to the French headquarters without any of the three approved mechanisms, without separate consent and without adequate encryption or de-identification. The fine was not disclosed. The lesson: a breach investigation can expose underlying transfer compliance gaps.

Checklist for companies

Count your exports: track how many individuals' data leaves China each calendar year, separating sensitive data.
Pick the right route and keep filings current; consider certification for intra-group transfers.
Get separate consent and update privacy notices for overseas transfers.
Schedule audits if you pass 10 million individuals, and appoint a PI protection officer above 1 million.
Identify important data by monitoring sector catalogs.
Prepare for incidents: China now requires reporting within hours for serious events, and breach investigations can trigger wider penalties.