China Cybersecurity Law penalties and fines

The consolidated Cybersecurity Law reflects the 2025 amendment effective 1 January 2026. A network operator is the owner or manager of a network or a network service provider. Failure to perform the general classified-protection and incident-response duties in Articles 23 and 27 can lead to an order to correct, a warning, and an optional RMB 10,000-50,000 fine. Refusal to correct or resulting cybersecurity harm raises the organizational fine to RMB 50,000-500,000, with RMB 10,000-100,000 for directly responsible managers and other directly responsible personnel.

A critical information infrastructure operator has additional duties, including security organization and staffing, disaster-recovery backup, exercises, security agreements, and at-least-annual assessment. A breach of the listed CII duties can draw an order to correct, warning, and optional RMB 50,000-100,000 fine. Refusal to correct or resulting cybersecurity harm raises the operator fine to RMB 100,000-1 million, with RMB 10,000-100,000 for responsible personnel.

A provider that sets a malicious program, fails to act immediately on a product or service vulnerability, fails to notify users or report as required, or stops security maintenance without authority can receive an order and warning. Refusal to correct or resulting cybersecurity harm can bring an RMB 50,000-500,000 fine and an RMB 10,000-100,000 fine for the directly responsible manager. Malicious-program and vulnerability failures that cause the serious or especially serious consequences described in Article 61 move into its higher tiers.

A CII operator that uses a network product or service without the required security review, or after it failed review, may be ordered to correct within a time limit, stop using it, and eliminate the national-security effect. The operator is also subject to a fine of one to ten times the procurement amount, while directly responsible managers and other directly responsible personnel face RMB 10,000-100,000.

A data processor that fails to establish required security management and technical measures, monitor and remedy risks, respond to an incident, or conduct and report a required important-data assessment may receive an order to correct, a warning, and an optional RMB 50,000-500,000 fine. Directly responsible managers and other directly responsible personnel may be fined RMB 10,000-100,000. Refusal to correct or serious consequences such as a large data leak raise the organization fine to RMB 500,000-2 million and the responsible-person fine to RMB 50,000-200,000; business suspension, closure for rectification, or license revocation may also follow.

A violation of the national core-data management system that harms national sovereignty, security, or development interests carries an RMB 2-10 million fine and may also bring business suspension, closure for rectification, or license revocation. Criminal responsibility applies when the conduct constitutes a crime. Core data is the narrower, more serious category for data tied to national security, the lifeline of the national economy, important people's livelihoods, or major public interests; it is not a synonym for all important data.

The MIIT app filing notice requires an app organizer providing internet information services in China to complete filing before service begins. An access provider, distribution platform, or smart-terminal manufacturer must not provide access, distribution, or pre-installation for an unfiled app. The notice says provincial communications administrations should handle unfiled or unlawful apps under the relevant laws and regulations; it does not state one universal app-filing fine.

The CAC app provisions prescribe operational measures, and other laws may also apply. An app provider may warn a user, restrict functions, or close an account for violations under law and the service agreement. A distribution platform may warn an app, suspend service, or remove it, while retaining records and reporting to the authority. Check the applicable statute or regulation separately to determine whether it also authorizes an administrative fine.

For unlawful personal-information processing, PIPL Article 66 provides a separate route. The ordinary sequence is an order to correct, warning, confiscation of illegal gains, and an order to suspend or terminate service for an unlawfully processing app; refusal to correct can add an organizational fine of up to RMB 1 million and an RMB 10,000-100,000 fine for responsible personnel. For a serious violation, the provincial-level or higher authority may impose up to RMB 50 million or 5% of the preceding year's turnover, plus business or licence measures, and RMB 100,000-1 million for responsible personnel. The serious tier is not the default outcome for every app or privacy defect.

Build the penalty analysis from evidence: identify the regulated actor, the duty and article, the act or omission, the date and law version, whether correction was ordered, whether the actor refused or repeated the conduct, and what consequence occurred. Keep organizational exposure separate from fines for managers and other directly responsible personnel.

A statutory maximum is not a predicted outcome. The Cybersecurity Law expressly preserves the Administrative Penalty Law rules on lighter, mitigated, or no punishment. Case-specific enforcement also depends on the competent authority, evidence, harm, remedial action, and any overlapping law. This page supports issue spotting, not an individualized penalty opinion.