China's internet regulatory authority and top prosecutors
have recently released a series of enforcement actions and cases,
aimed at highlighting enforcement priorities in the data security
realm over the last year. In 2025, enforcements under the Chinese
Cybersecurity Law, the Data Security Law, the Personal Information
Protection Law, and the Regulations on the Security Management of
Network Data, focused primary on data security compliance, illegal
cross-border transfers, and violations of personal information
rights.
Companies were cited for violations related to over-collection
of data, noncompliance with network data security rules, improper
storage, allowing unrestricted access to sensitive information, and
violating consent requirements.