← Data protection and cybercrime laws by country, compared
China: data protection law, cybercrimes, fines and penalties
PIPL and the amended Cybersecurity Law (in force since 1 Jan 2026) under the CAC, with 4-hour reporting of serious incidents and mandatory PIPL audits.
- Law
- PIPL + Cybersecurity Law (CSL, amended)
- Authority
- CAC (Cyberspace Administration of China)
- Max fine
- PIPL: RMB 50M or 5% of annual revenue; CSL: up to RMB 10M in serious cases
- Breach notification
- Relatively serious incident: preliminary in 4h, full report in 72h, analysis within 30 days
- DPO
- PIPO mandatory above 1M individuals (registered with the CAC)
Crimes
| Illegal intrusion into computer systems | Art. 285 Criminal Law | Up to 3 years; 3 to 7 in serious cases |
| Sabotage of computer systems | Art. 286 Criminal Law | — |
| Infringement of personal information | Art. 253-1 Criminal Law | Up to 3 years; 3 to 7 in especially serious cases |
| Illegal online activity and aiding cybercrime | Arts. 287-1 and 287-2 Criminal Law | — |
| Fraud | Art. 266 Criminal Law | — |
Risks
- Expanded extraterritorial reach of the CSL
- Mandatory PIPL audits (every 2 years above 10M individuals)
- Cross-border data transfers (security assessment and standard contracts)
- 4-hour deadline for relatively serious incidents
- Amended CSL: general corporate fine raised from RMB 100k to 500k; individuals up to RMB 1M; first explicit mention of AI
- CAC incident-reporting measures in force since 1 Nov 2025
Source: Arnold & Porter – China 2025 Year in Review · Covington – Global Policy Watch · NPC – PIPL · NPC