China's internet regulator, the Cyberspace Administration of China (CAC), fined ride-hailing giant Didi Global RMB 8.026 billion, roughly $1.2 billion, in July 2022 for violations of the Personal Information Protection Law (PIPL), the Data Security Law, and the Cybersecurity Law. Four years later that fine is still the largest PIPL-adjacent penalty on record, even as enforcement has broadened into a steady stream of app rectification campaigns, cross-border transfer reviews, and smaller local fines that rarely make international headlines.
Chinese regulatory enforcement data is not as openly published as GDPR's enforcement trackers in the EU. Many administrative decisions are recorded only as warnings with no disclosed amount, and no single official CAC registry lists every case the way some EU data protection authorities do. The figures below come from named CAC announcements, law firm reporting on those announcements, Chinese state media, and one disclosed-methodology academic tracker, with sample sizes and cutoff dates stated wherever the source publishes them.
What is the largest fine ever issued under China's PIPL?
The CAC's RMB 8.026 billion fine against Didi Global, announced 21 July 2022, is still the largest penalty tied to a PIPL violation as of 2026. The investigation found Didi had collected personal information excessively, stored data unlawfully, and continued operating a data-sharing arrangement with a state security risk after being told to stop. Didi's chairman Cheng Wei and president Liu Qing were each fined RMB 1 million personally, about $148,000 at the time, the maximum individual penalty PIPL allows.
Only one other company has been fined by the CAC in a headline action that explicitly cites PIPL. In September 2023, the CAC fined CNKI (China National Knowledge Infrastructure), the country's largest academic database, RMB 50 million, about $7 million, for collecting personal information without consent and failing to provide adequate privacy notices. It was the first PIPL-based fine against an education-sector platform and only the second PIPL fine of any kind since the law took effect in November 2021.
| Entity | Fine (RMB) | Fine (USD, approx.) | Year |
|---|---|---|---|
| Didi Global | 8.026 billion | 1.2 billion | 2022 |
| CNKI | 50 million | 7 million | 2023 |
| Ctrip (Shanghai affiliate) | 10 million | 1.4 million | 2026 |
Named PIPL-adjacent fines vary by roughly three orders of magnitude, and that gap is the point: the CAC reserves its billion-dollar penalties for the smallest number of the largest platforms, while everything else in the enforcement system runs at a very different scale.
What changed in China's data law penalties for 2026?
China's National People's Congress Standing Committee adopted amendments to the Cybersecurity Law on 28 October 2025 that took effect 1 January 2026, raising the maximum fine for network operators and critical information infrastructure operators to RMB 10 million, about $1.4 million, when a violation causes what the law calls particularly serious consequences, with a parallel RMB 1 million cap for the individual found responsible. Ordinary businesses without critical infrastructure status face a lower ceiling of RMB 500,000. The same amendment aligned cybersecurity provisions more closely with PIPL and added dedicated obligations around artificial intelligence governance.
Figure 1: Milestone PIPL, CSL, and DSL enforcement actions and rule changes, 2019 to 2026. Source: CAC announcements reported by Mayer Brown, Global Times, Reed Smith, and DLA Piper.
The 1 January 2026 effective date also completed PIPL's cross-border transfer framework. The CAC and the State Administration for Market Regulation (SAMR) jointly issued the Measures for Certification of Cross-Border Personal Information Transfer on 14 October 2025, adding a formal certification pathway alongside the existing security-assessment and standard-contract routes that PIPL had already established.
How does China regulate cross-border data transfers?
PIPL Articles 38 through 40 give a data processor three lawful ways to move personal information out of China, and which one applies depends mostly on data volume and whether the export touches CAC-designated important data.
Figure 2: The three lawful pathways for moving personal data out of China, and which one applies. Source: PIPL Articles 38 to 40, CAC Measures for Certification of Cross-Border Personal Information Transfer, effective 1 January 2026.
| Mechanism | Trigger | Approving body | Status as of 2026 |
|---|---|---|---|
| Security assessment | Important data, CIIO exports, or high-volume PI | Cyberspace Administration of China | Thresholds eased April and October 2025 |
| Standard contract filing | Mid-volume personal information exports | Provincial CAC branch | In effect since June 2023 |
| Certification | Intra-group multinational transfers | CAC-accredited body, jointly with SAMR | Effective 1 January 2026 |
Ctrip's RMB 10 million fine in June 2026 is a reminder that the mechanism a company skips, not the volume of data it moves, is usually what draws a penalty: the Shanghai CAC's finding was that Ctrip transferred user data overseas without completing any of the three required steps, not that the transfer itself was prohibited. A website's own privacy policy is typically the first document a PIPL review checks for a stated legal basis and cross-border disclosure, so any site handling China-linked personal information should confirm those disclosures are current; you can generate a privacy policy that documents consent, retention, and transfer mechanisms in the format regulators expect to see first.
How strict is China's cross-border security assessment process?
As of March 2025, the CAC had completed review of 298 security assessment submissions, of which 44 involved important data, according to an Arnold & Porter advisory summarizing the CAC's own figures. Only 7 of those 44 failed the assessment, a rejection rate of 15.9 percent. The 44 submissions covered 509 individual important-data items, of which 325, or 63.9 percent, were approved for export.
Figure 3: Most cross-border assessment applications never involve CAC-designated important data, and outright rejection is rare even when they do. Source: CAC figures reported by Arnold & Porter, June 2025 advisory.
The practical reading is that the security assessment functions closer to a filing check than a gatekeeping wall. The vast majority of the 298 reviewed submissions did not involve important data at all, and even within the stricter important-data subset, roughly two out of three individual data items cleared for export. Companies that fail tend to fail on documentation and completeness, not on the underlying legality of the transfer itself.
How many apps has China ordered rectified for illegal data collection?
Separate from fine-based enforcement, China runs an ongoing, multi-agency campaign against apps and SDKs that collect personal information unlawfully. As of August 2026, more than 4,000 apps and SDKs had been urged to complete compliance rectifications since the campaign began, according to Xinhua reporting on the joint CAC, Ministry of Industry and Information Technology, and Ministry of Public Security effort. Over 1,100 of those were publicly named for violations, and more than 400 were penalized, including removal from app stores.
Figure 4: Scope of the ongoing app and SDK rectification campaign, as of August 2026. Source: Xinhua, "China cracks down on apps for infringement of personal information" (19 August 2026).
The gap between the 4,000 apps urged to fix violations and the roughly 400 that were actually penalized shows how the campaign is structured: most operators correct the problem after being named, and only a minority face store removal or a fine. Separately, Xinhua reports that Chinese police resolved more than 40,000 cases involving personal information infringement between 2020 and 2024, a scale of routine enforcement well beyond anything captured in headline CAC fine announcements.
What do most PIPL and Cybersecurity Law penalties actually look like?
The billion-dollar Didi fine is the exception, not the pattern. Data Compliance China, an enforcement tracker maintained by Dr. Hong Yanqing, a data protection researcher, recorded 392 administrative decisions citing the Data Security Law or PIPL between January 2024 and 3 June 2026. Of those, 74.5 percent were warnings with no monetary penalty, 16.6 percent included a fine, and 92 percent were issued by public security bureaus rather than the CAC itself. Fine amounts clustered near the statutory floor, typically around RMB 50,000; the largest in the sample was an RMB 80,000 fine against a hospital.
Info
This tracker is a single-author academic research project with a disclosed sample and cutoff date, not an official CAC registry. Treat its percentages as the best available public estimate of enforcement patterns, not a complete count of every decision China's regulators have issued.
A separate sample from the same tracker, covering 6,214 Cybersecurity Law administrative penalty decisions from 1 January 2025 to 1 July 2026, found that 98.3 percent were issued by public security bureaus, 61 percent from district-level offices. Total penalties across the sample reached RMB 179.35 million, but 66.4 percent of that sum came from a single case against livestreaming platform Kuaishou. The median fine among the 1,923 decisions that carried any monetary penalty was just RMB 1,800, and 69 percent of all 6,214 decisions carried no monetary penalty at all.
Figure 5: The CAC issues the headline fines, but routine Cybersecurity Law enforcement is overwhelmingly local police work. Source: Data Compliance China enforcement tracker, 6,214 decisions, 1 January 2025 to 1 July 2026.
The Bottom Line
The RMB 8.026 billion Didi fine is still the number most people associate with Chinese data enforcement, and it is the right hook stat because it remains the largest of its kind four years on. But it describes the exception, not the system: the underlying data shows thousands of quiet warnings, a median fine measured in low thousands of RMB, and a cross-border transfer regime that approves most applications once a company files the correct paperwork. For any business with China-linked users, the practical risk is documentation gaps, not billion-dollar exposure, and the 2026 penalty increases under the amended Cybersecurity Law raise the ceiling for exactly the kind of case that used to draw only a warning. China's approach sits inside a broader global pattern covered in our privacy laws by country tracker, and the same slow-then-fast enforcement curve is showing up elsewhere, including in Brazil's LGPD enforcement and in India's DPDP Act rollout as its own rules phase in.
Frequently Asked Questions
What is the largest fine ever issued under China's PIPL? The RMB 8.026 billion fine, roughly $1.2 billion, that the CAC issued against Didi Global in July 2022 remains the largest PIPL-adjacent penalty as of 2026, combining violations of the PIPL, the Data Security Law, and the Cybersecurity Law.
How many companies has China fined directly under PIPL? Only two companies have been fined in a headline enforcement action explicitly citing PIPL provisions: Didi Global in 2022 and CNKI, fined RMB 50 million in September 2023. Most day-to-day PIPL and Data Security Law enforcement, per Data Compliance China's tracker of 392 decisions from 2024 through mid-2026, results in warnings rather than fines.
What are China's three cross-border data transfer mechanisms? PIPL Articles 38 through 40 set out three pathways: a mandatory CAC security assessment for important data or high-volume transfers, a standard contract filing for mid-volume transfers, and a certification route for intra-group multinational transfers, a framework completed when the CAC and SAMR's certification measures took effect on 1 January 2026.
How many apps has China ordered rectified for illegal data collection? More than 4,000 apps and SDKs have been urged to complete compliance rectifications in the 2025 to 2026 campaign, with over 1,100 publicly named and more than 400 penalized or removed from app stores, according to Xinhua's August 2026 reporting on the joint CAC, MIIT, and Ministry of Public Security campaign.
Where the Numbers Come From
- Mayer Brown. (2022). "The CAC is Coming: Didi Chuxing Fined a Record-breaking USD 1.2 Billion for Breach of Data Protection Regulations." RMB 8.026 billion fine, 21 July 2022, individual fines of RMB 1 million each.
- Global Times. (2023). "China's cybersecurity watchdog fines academic database 50m yuan over mishandling of personal information." CNKI fine, September 2023.
- DLA Piper Privacy Matters. (2026). "China: China's Data Regulator Means Business, the Education Phase is Over." Ctrip RMB 10 million fine, June 2026, and enforcement trend commentary.
- Reed Smith. (2025). "China Approves Major Amendments to Cybersecurity Law, Effective 1 January 2026." Penalty ceiling figures, amendment adopted 28 October 2025.
- Arnold & Porter. (2025). "China Clarifies Cross-Border Data Transfer Rules: Practical Guidance for Compliance." CAC security assessment figures, cutoff March 2025.
- China Briefing. (2025). "China Releases Cross-Border Data Transfer Certification Measures." Measures issued 14 October 2025, effective 1 January 2026.
- Xinhua. (2026). "China cracks down on apps for infringement of personal information." App rectification campaign totals, 19 August 2026.
- Data Compliance China. Enforcement tracker maintained by Dr. Hong Yanqing. 392 DSL and PIPL decisions (Jan 2024 to Jun 2026) and 6,214 Cybersecurity Law decisions (Jan 2025 to Jul 2026), checked August 2026.
Note: All figures verified as of August 2026. Chinese regulatory enforcement data has limited public transparency compared to jurisdictions like the EU; several figures in this post, particularly the Data Compliance China tracker percentages, come from a disclosed-methodology secondary source rather than an official government registry, and are flagged accordingly in the text above.
