ChinaPersonal Information Protection Law, Supervision and Legal Liability
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- on_request
- Who audits it
- Independent third party
- Where the report goes
- Filed with regulator
What it requires
- Comply with lawful CAC and sectoral-regulator investigation, including document production and on-site inspection.
- Bear the burden of proving the absence of fault once an individual establishes harm from unlawful personal information processing, or pay compensation.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P5Legal, regulatory, and contractual requirements regarding privacy are understood and managed.
- FINOS AIGF
- AIR-PREV-005System Acceptance Testing
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-PREV-024Human-in-the-Loop Action Approval Gate
- AIR-DET-004AI System Observability
- AIR-DET-011Human Feedback Loop for AI Systems
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
PIPL Article 71 provides that a violation constituting a public security administration offense draws punishment under the Public Security Administration Punishments Law, and a violation constituting a crime draws criminal liability according to law. The offence charged for unlawfully obtaining, selling or providing citizens' personal information in serious circumstances (情节严重) is Article 253-1 of the Criminal Law, applied by the Supreme People's Court and Supreme People's Procuratorate interpretation Fa Shi [2017] No. 10; its sentencing terms are those of the Criminal Law itself.
Penalty structure
PIPL Article 66 sets a two-tier structure. The ordinary tier, triggered when a processor refuses to correct a violation, caps the organizational fine at RMB 1,000,000 and the fine on the directly responsible manager or other directly responsible individual at RMB 10,000 to 100,000. Where the circumstances are serious, a provincial-or-above personal information protection department may instead impose a fine of not more than RMB 50,000,000 or not more than 5 percent of the preceding year's turnover, may order suspension of the relevant business or a shutdown for rectification, and may have the relevant business permit or business licence revoked; the responsible individual's fine rises to RMB 100,000 to 1,000,000, with a possible bar from serving as a director, supervisor, senior manager, or personal information protection officer for a period. The statute's own text joins the RMB 50,000,000 figure and the 5 percent turnover figure with 'or' (或者) rather than an explicit 'whichever is higher' comparative; this row reads the serious-violation ceiling as the higher of the two, which is an interpretation of how the caps combine and not the statute's own comparative language.
- Rule
- Higher of
- As of
- Currency
- CNY
- Fixed cap
- 50,000,000
- Turnover percentage cap
- 5
Who enforces it
Enforcement body
Cyberspace Administration of China (CAC), which under PIPL Article 60 coordinates and leads personal information protection and related supervisory work nationally. Relevant departments of the State Council carry out personal information protection and supervision within their own areas of responsibility under the same article, and county-level-or-above local government departments hold personal information protection and supervisory duties as determined by state regulations; the statute refers to this group collectively as the departments performing personal information protection duties.
Settledness
- As of
- Open questions
- What circumstances make a violation 情节严重 ("serious circumstances") so that the department at provincial level or above may impose the higher fine under Article 66?
- Is 上一年度营业额 ("turnover of the previous year") in Article 66 the handler's own turnover for the previous year or the turnover of the group the handler belongs to?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 63 lets the protection departments consult and copy a handler's contracts, records, account books and other materials on the processing and requires the handler to cooperate, and Article 69 puts the burden on the handler to prove it was not at fault for damage from unlawful processing; neither can be met without records the handler keeps, though these articles do not themselves say which. Article 64 lets a department order a compliance audit on a risk finding or an incident. The row's existing audit keys, which carry only that route, are left as written; the departments' own inspection under Article 63 is a regulator check on the same records.
- Kind
- Implicit
- As of
- Provision
- PIPL Arts. 63, 64 and 69
- Trigger
- personal_data_processing
What this law does
The Cyberspace Administration of China leads coordination, with sectoral State Council departments and their local counterparts supervising within their own scope; investigative powers include interviews, record examination, on-site inspection, and, with approval, seizure of equipment.
Ordinary violations draw a warning, confiscation of gains, and service suspension, escalating on non-correction to fines up to RMB 1,000,000 for the entity and RMB 10,000 to 100,000 for the responsible individual; grave violations draw fines up to RMB 50,000,000 or 5 percent of the prior year's revenue, possible business suspension or license revocation, individual fines of RMB 100,000 to 1,000,000, and a bar on serving as a director, supervisor, senior manager, or protection officer of a related enterprise.
A handler that cannot prove itself free of fault bears civil compensation liability, and procuratorates and designated organizations may bring public-interest suits over mass violations.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .