Chinese Enforcement Actions Reinforce Need for Global Privacy Compliance Strategy

China’s internet regulatory authority and top prosecutors have recently released a series of enforcement actions and cases, aimed at highlighting enforcement priorities in the data security realm over the last year. In 2025, enforcements under the Chinese Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, and the Regulations on the Security Management of Network Data, focused primary on data security compliance, illegal cross-border transfers, and violations of personal information rights.

Companies were cited for violations related to over-collection of data, noncompliance with network data security rules, improper storage, allowing unrestricted access to sensitive information, and violating consent requirements.

Chinese authorities have stated that enforcement priorities in 2026 will include increased oversight in the “digital sphere” including activities of illegal collection and misuse of personal data. Enforcement actions in 2026 are also expected to focus on data leaks and improper network governance and increased penalties for data breaches.

To prevent being the focus of China’s regulatory authority, companies should focus on:

• Ensuring adequate safeguards are in place to protect data in transit and at rest;
• Completing required cybersecurity classification and grading, where required;
• Implementing effective security management policies and access policies, including strong password requirements;
• Completing necessary assessments or certifications where required for cross-border transfers; and
• Publishing adequate notices disclosing personal information collection and processing practices, and do not exceed those disclosed practices.

While specific compliance requirements will vary depending on the business, any data collection, storage, or processing occurring in China will be subject to increased scrutiny in 2026, requiring businesses to take a closer look to ensure proper data security is in place.

Importantly, although the safeguards may have overlap across different international laws and standards, cross-border transfer and localization principles are causing harder operational issues for businesses. With enforcement ramping up, businesses should carefully consider their global compliance strategy.