Yes. Selling or providing someone’s personal information is a crime in China under Article 253-1 of the Criminal Law, and it is one of the easiest white-collar offences to trigger — the thresholds are counted in data records, not just in money.
What the law says
Article 253-1 of the Criminal Law (as amended by Amendment IX in 2015) makes it an offence to sell or provide personal information in violation of state regulations where the circumstances are “serious”. The basic sentence is up to three years in prison; where the circumstances are “especially serious”, three to seven years. Anyone who obtains personal information by theft or other illegal means faces the same penalty, and companies face fines plus liability for their responsible managers.
The thresholds come from the 2017 judicial interpretation. Selling or providing information is generally “serious” when it involves, for example, 50 pieces of highly sensitive data (location traces, communication content, credit or property information), 500 pieces such as accommodation, health or transaction records, or 5,000 pieces of other personal information — or when illegal gains reach RMB 5,000.
This is not only a criminal risk. The Personal Information Protection Law (PIPL, 2021) also lets regulators fine a company up to RMB 1 million, and up to RMB 50 million or 5% of the previous year’s turnover in serious cases, and to ban responsible individuals from management roles.
What this means in practice
The trap is often commercial, not obviously criminal. A sales team that buys a lead list, a company that “shares” customer data with a marketing partner, or an employee who copies a contact database to a new job can all cross the line. Because liability attaches both to the company and to the people who approved or carried out the conduct, executives and IT staff can be personally exposed.
A quick example
Picture a marketing firm that buys a 20,000-name contact list from a data broker and uses it for cold calls. On these rules the volume alone can make the conduct “serious”, and the broker’s record of the sale gives investigators a clear paper trail. (This is an illustrative scenario, not a specific case.)
The bottom line: in China personal data is legally protected property — treating a customer list as a free asset is how ordinary businesses end up facing criminal charges.
FAQ
Q: Is it a crime to sell personal data in China?
A: Yes. Article 253-1 of the Criminal Law criminalises selling or providing personal information in violation of state regulations where the circumstances are serious.
Q: How many records trigger prosecution?
A: Under the 2017 interpretation, roughly 50 highly sensitive records, 500 sensitive records, or 5,000 ordinary records — or illegal gains of RMB 5,000.
Q: Can a company be punished, or only the employee?
A: Both. The company can be fined and its responsible managers held criminally liable alongside the individuals who acted.
Q: Does PIPL add more risk?
A: Yes. PIPL allows administrative fines of up to RMB 1 million, and up to RMB 50 million or 5% of turnover for serious violations, plus management bans.
Wang Guan | Co-founder, Beijing Haolue Law Firm | +86 17813108512