PrivacyChina

China Privacy Law PIPL penalties and enforcement exposure

PIPL Article 66 has a corrective tier and a serious-circumstances tier. The maximum fine is not automatic for every violation.

Exposure can also include confiscation of unlawful gains, service or business restrictions, licence consequences, fines and role restrictions for responsible personnel, civil damages, public-interest litigation, credit-record publication, and public-security or criminal liability.

Back to main artifact Review sources

Author

Sorena AI

Published

Jul 5, 2026

Updated

Jul 24, 2026

Sections

Structured answer sets in this page tree.

Primary sources

Cited legal and guidance references.

Publication metadata

Sorena AI

Published Jul 5, 2026

Updated Jul 24, 2026

Overview

A that violates PIPL does not automatically receive the RMB 50 million or 5% maximum. Article 66 first allows correction, a warning, confiscation of unlawful gains, and suspension or termination of an unlawfully processing App. Refusal to correct can lead to lower-tier fines. allow the higher organizational fine and additional business and individual sanctions. The text of Article 66 does not define serious circumstances or the geographic and accounting base for prior-year turnover, so this page does not calculate a case-specific maximum.

Section 1

Who and what PIPL can reach

PIPL applies to personal-information processing in China. It can also apply to processing outside China when the activity is for providing products or services to people in China, analyzes or assesses their behavior, or falls within another condition set by law or administrative regulation. An overseas within that extraterritorial scope must establish a dedicated organization or appoint a representative in China and report the organization or representative to the protection authority.

Identify the actor and violated duty before estimating exposure. Article 66 covers processing that violates PIPL and failures to perform PIPL personal-information protection obligations. State organs have a separate responsibility rule in Article 68. Other statutes and sector rules may apply to the same conduct, so Article 66 is not a universal ceiling for every privacy, cybersecurity, data-security, consumer, employment, or criminal consequence.

Identify whether the organization is the , an entrusted processor, a joint processor, an overseas recipient, an App provider, or another regulated actor for the processing at issue.
Map the alleged conduct to the actual duty: legal basis and consent, notice, sensitive information, individual rights, automated decisions, security controls, impact assessment, breach response, cross-border transfer, audit, or another provision.
Separate PIPL exposure from penalties available under other applicable laws. Do not add unrelated maximums together without a legal basis and case-specific analysis.

Sources for this answer

PRC Personal Information Protection Law

Articles 3 and 53 establish territorial and specified extraterritorial scope and the local organization or representative duty; Articles 21 and 73 distinguish entrusted processing and define a personal information processor; Articles 66 and 68 separate general violations from state-organ responsibility.

Section 2

Article 66 administrative penalty tiers

Article 66 separates the available measures by posture and seriousness. It does not say that every initial violation receives a fine, and it does not make the upper limit the expected amount. The competent authority determines the applicable measures in the enforcement case.

Is every PIPL violation fined RMB 50 million or 5% of turnover?

No. Those are alternative upper limits available for the serious-circumstances tier under Article 66. The same article provides corrective measures for violations and lower fines when an organization refuses to correct. It does not make the maximum automatic, define a standard fine for every violation, or state the turnover calculation base. Determine the violated duty, enforcement posture, facts, applicable tier, entity, and authority interpretation before estimating exposure.

Can managers or privacy officers be fined personally?

Yes, when they are directly responsible managers or other directly responsible personnel. For refusal to correct, Article 66 sets a range of RMB 10,000 to RMB 100,000. In , it sets a range of RMB 100,000 to RMB 1 million and allows a temporary bar from specified director, supervisor, senior-management, or personal information protection officer roles. A title alone does not establish direct responsibility; that depends on the person's role and the case facts.

Initial corrective measures: an authority may order correction, issue a warning, confiscate unlawful gains, and order an App that unlawfully processes personal information to suspend or terminate service.
Refusal to correct: the organization may also be fined up to RMB 1 million. Directly responsible managers and other directly responsible personnel may be fined from RMB 10,000 to RMB 100,000.
: a provincial-level or higher protection authority may order correction, confiscate unlawful gains, and fine the organization up to RMB 50 million or up to 5% of its prior-year turnover.
Additional serious-case measures: the authority may order suspension of related business or suspension for rectification and may notify another competent authority to revoke a relevant business permit or business licence.
Responsible personnel in a serious case: directly responsible managers and other directly responsible personnel may be fined from RMB 100,000 to RMB 1 million. The authority may also bar them for a period from serving as a director, supervisor, senior manager, or personal information protection officer of a relevant enterprise.
Turnover caveat: Article 66 states 'prior-year turnover' but does not specify in its text whether the base is worldwide, China-only, group, or entity turnover, or how it must be calculated. A case-specific maximum requires the controlling authority's interpretation and the relevant entity and accounting facts.

Sources for this answer

PRC Personal Information Protection Law, Article 66

Binding source for corrective orders, warnings, confiscation, App service restrictions, refusal-to-correct fines, serious-circumstances fines and business measures, responsible-person fines, and temporary role restrictions.

Section 3

Other PIPL consequences

Administrative fines are only one part of PIPL exposure. Articles 63-71 address investigative powers, risk remediation, credit records, state-organ responsibility, civil liability, public-interest litigation, and public-security or criminal liability.

Can individuals claim damages under PIPL?

Yes, if personal-information processing infringes their rights and causes harm. Under Article 69, the bears tort liability if it cannot prove it was not at fault. Damages are determined from the individual's loss or the processor's resulting gain; when both are difficult to determine, the court sets the amount according to the circumstances. The claimant still needs a case within Article 69, and this page cannot determine causation, harm, fault, or damages for a specific dispute.

Does PIPL allow public-interest litigation?

Yes. Article 70 allows a people's procuratorate, a consumer organization designated by law, or an organization designated by the national cyberspace authority to sue when unlawful processing infringes the rights of many individuals. This is separate from an individual's Article 69 damages claim and from an authority's administrative enforcement.

Investigation and controls: protection authorities may question parties, inspect and copy contracts and records, conduct on-site inspections, and, with the required approval, seal or seize equipment or items supported by evidence of unlawful processing. Parties must assist and may not refuse or obstruct.
Risk remediation and audit: where processing presents a relatively high risk or a personal-information security incident occurs, an authority may interview the legal representative or principal responsible person or require an audit by a professional institution. The processor must rectify and eliminate the risk as required.
Credit record: Article 67, not Article 66, provides that a PIPL violation is entered into a credit record and publicized in accordance with applicable laws and administrative regulations.
Civil damages: when processing infringes personal-information rights and causes harm, a processor that cannot prove it was not at fault bears tort liability. Damages are based on the individual's loss or the processor's gain; if both are difficult to determine, the amount is set according to the circumstances.
Public-interest actions: where unlawful processing infringes the rights of many individuals, a people's procuratorate, a legally designated consumer organization, or an organization designated by the national cyberspace authority may bring an action.
Public-security and criminal exposure: conduct constituting a public-security violation is handled under the applicable public-security rules; conduct constituting a crime is subject to criminal liability.

Sources for this answer

PRC Personal Information Protection Law, Articles 63-71

Binding source for authority powers, interviews and compliance audits, credit-record publication, state-organ responsibility, fault-based civil liability with a reversed proof burden, damages, public-interest actions, and public-security or criminal liability.

Section 4

Data export and App enforcement

The data export measures do not create one self-contained fine table. Their liability provisions direct violations to PIPL and other applicable cybersecurity, data-security, certification, or criminal rules. The governing instrument and actor must therefore be identified before stating a penalty.

For Apps, PIPL Article 66 expressly allows suspension or termination of service for an App that unlawfully processes personal information. The 2022 App provisions separately state that App providers and distribution platforms that violate those provisions are handled by cyberspace and other competent authorities within their responsibilities under relevant laws and regulations.

Standard-contract route: the provincial or higher cyberspace authority may interview a processor when an export presents a relatively high risk or a personal-information security incident occurs; the processor must rectify and eliminate the risk. Violations are handled under PIPL and other applicable laws, and crimes are prosecuted.
Security-assessment route: the national cyberspace authority may order termination of an approved export that no longer meets data export security requirements. To continue, the processor must rectify and reapply. Violations are handled under the Cybersecurity Law, Data Security Law, PIPL, and other applicable laws.
2024 cross-border provisions: local cyberspace authorities may require rectification when they find a relatively high risk or data-security incident. Refusal to correct or serious consequences can lead to legal responsibility under applicable law.
Certification route: violations of the Personal Information Export Certification Measures are handled under PIPL, the Network Data Security Management Regulations, the Certification and Accreditation Regulations, and other applicable rules; criminal conduct is prosecuted.
Do not assume that a contract filing receipt, assessment result, or certification proves general PIPL compliance. Each mechanism addresses a transfer route and does not remove the underlying notice, consent where required, impact-assessment, security, individual-rights, and recipient-protection duties.

Sources for this answer

Measures for the Standard Contract for Personal Information Export

Articles 11-12 establish interview and rectification powers and refer violations to PIPL and other applicable laws, including criminal liability.

Measures for Security Assessment of Data Export

Articles 17-18 support termination, rectification, reapplication, and enforcement under the Cybersecurity Law, Data Security Law, PIPL, and other applicable laws.

Provisions on Promoting and Regulating Cross-border Data Flow

Articles 10-12 preserve underlying PIPL duties, require security measures and incident reporting, and provide for rectification and legal responsibility.

Personal Information Export Certification Measures

Article 17 identifies the legal frameworks used to handle certification-measure violations and preserves criminal liability.

Mobile Internet Application Information Service Management Provisions

Articles 12, 20-21 and 25 support App personal-information duties, platform review and service measures, and enforcement under relevant laws and regulations.

Section 5

Evidence to preserve during an investigation or remediation

Preserve the record before changing systems or documents. It should show what happened, which duty applied, who decided, what the organization knew, how it responded, and whether the corrective action is complete. Do not alter or recreate evidence to make the record look cleaner.

Scope and role: data map, processing purpose and method, affected people and data categories, sensitive-information and minors analysis, actor roles, system and App versions, jurisdictions, and cross-border recipients.
Legal and control record: notices, consent or other processing basis, individual-rights workflow, contracts, impact assessments, audit records, security measures, access logs, retention rules, export-route decision, filings, assessment results, and certifications.
Event record: detection time, known facts, affected systems and data, preservation steps, containment, remediation, notifications, complaints, regulator communications, instructions, owners, decisions, and completion evidence.
Responsibility record: governance documents, delegated authority, escalation paths, meeting decisions, training, prior findings, remediation commitments, and evidence showing who controlled or approved the relevant processing.
Exposure analysis: assess the Article 66 tier, individual responsibility, civil claims, public-interest litigation, credit consequences, and any separate law. Keep uncertainty explicit and update the analysis when the authority or facts change.

Sources for this answer

PRC Personal Information Protection Law

Articles 51, 55-57, 63-66 and 69 support security controls, impact-assessment and incident records, authority inspection powers, remediation, administrative exposure, and civil liability.

Personal Information Protection Compliance Audit Measures

Articles 5-11 and the audit guidelines support authority-directed audits, reports, remediation, and review of personal-information governance and processing controls.

Operationalize the requirement

Document the PIPL exposure and response

Connect the alleged conduct, applicable duty, actor, evidence, corrective action, authority direction, and unresolved legal questions.

Research workflow

Map official sources to evidence

Research Copilot connects each legal provision and exposure conclusion to the relevant facts, owner, and retained record.

Explore next step

Talk to Sorena

Review the China exposure

Review the actor, alleged violation, remediation record, and unresolved case-specific questions with Sorena.

Explore next step

Primary sources

References and citations

Measures for Security Assessment of Data Export

cac.gov.cn

Referenced sections

Articles 17-18 support termination, rectification, reapplication, and enforcement under the Cybersecurity Law, Data Security Law, PIPL, and other applicable laws.

Measures for the Standard Contract for Personal Information Export

cac.gov.cn

Referenced sections

Articles 11-12 establish interview and rectification powers and refer violations to PIPL and other applicable laws, including criminal liability.

Mobile Internet Application Information Service Management Provisions

cac.gov.cn

Referenced sections

Articles 12, 20-21 and 25 support App personal-information duties, platform review and service measures, and enforcement under relevant laws and regulations.

Personal Information Export Certification Measures

cac.gov.cn

Referenced sections

Article 17 identifies the legal frameworks used to handle certification-measure violations and preserves criminal liability.

Personal Information Protection Compliance Audit Measures

cac.gov.cn

Referenced sections

Articles 5-11 and the audit guidelines support authority-directed audits, reports, remediation, and review of personal-information governance and processing controls.

PRC Personal Information Protection Law

cac.gov.cn

Referenced sections

Articles 51, 55-57, 63-66 and 69 support security controls, impact-assessment and incident records, authority inspection powers, remediation, administrative exposure, and civil liability.

PRC Personal Information Protection Law, Article 66

cac.gov.cn

Referenced sections

Binding source for corrective orders, warnings, confiscation, App service restrictions, refusal-to-correct fines, serious-circumstances fines and business measures, responsible-person fines, and temporary role restrictions.

PRC Personal Information Protection Law, Articles 63-71

cac.gov.cn

Referenced sections

Binding source for authority powers, interviews and compliance audits, credit-record publication, state-organ responsibility, fault-based civil liability with a reversed proof burden, damages, public-interest actions, and public-security or criminal liability.

Provisions on Promoting and Regulating Cross-border Data Flow

cac.gov.cn

Referenced sections

Articles 10-12 preserve underlying PIPL duties, require security measures and incident reporting, and provide for rectification and legal responsibility.

Related guides