In short: yes. In China a data breach is not only an administrative or civil problem – it can be a crime, and both the company and its responsible managers can be prosecuted. The two main criminal hooks are Article 253-1 of the Criminal Law (infringing citizens’ personal information) and Article 286-1 (a network operator refusing to fulfil its security obligations). On top of that, the Personal Information Protection Law (PIPL) allows fines of up to RMB 50 million or 5% of annual turnover.

When does a leak become a crime?

Article 253-1 punishes anyone who, in violation of state rules, sells or provides citizens’ personal information to others, or illegally obtains it, where the circumstances are “serious”: up to three years’ imprisonment, or three to seven years if the circumstances are “especially serious.” A company can be liable as a unit, with a fine on the company and penalties on the directly responsible managers. The 2017 judicial interpretation (Fa Shi [2017] No. 10) sets concrete thresholds – for example, 50 items of highly sensitive data (trajectory, communications, credit or property information), 500 items of accommodation, health or transaction data, 5,000 items of other personal information, or illegal gains of RMB 5,000 or more. Article 286-1 targets platform operators: if a regulator orders you to fix a security failure and you refuse, and that causes serious harm such as a mass data leak, the responsible persons face up to three years.

The administrative side: PIPL

Under Article 66 of PIPL (effective 1 November 2021), a serious violation can bring a fine of up to RMB 50 million or 5% of the previous year’s turnover, plus orders to suspend business, rectify, or revoke licences, and personal fines of up to RMB 1 million on responsible individuals. When criminal and administrative liability stack, the exposure for a foreign-invested company is substantial.

What this means in practice

Most enforcement starts with a breach report or a regulator’s inspection – not with a criminal investigation. What usually decides whether it escalates is documentation: whether you had a lawful basis for processing, a security programme and an incident-response plan, and whether you co-operated and fixed the problem quickly. “We didn’t know” is not a defence for the responsible manager, and data handled by an overseas parent company is often scrutinised under the cross-border transfer rules.

A quick scenario (hypothetical)

A foreign e-commerce company’s marketing database is breached, exposing 80,000 customers’ names, phone numbers and addresses. Because the data includes contact and transaction information, the 500-item threshold is far exceeded. If the company had ignored an earlier regulator warning to patch the system, managers could face Article 286-1; if an employee had sold the data, Article 253-1 applies to the individual and unit liability to the company. The realistic first step is a parallel response: technical containment, regulator notification, and legal advice on the criminal exposure of individuals.

The bottom line: a data breach in China can trigger criminal liability for the company and its managers, not just a fine – so data compliance is a board-level legal risk, not an IT matter.

Related Reading

Wang Guan | Co-founder, Beijing Haolue Law Firm | +86 17813108512