CHINA Law and Practice Contributed by: Jihong Chen, Zhong Lun Law Firm
Binding Force of Guidance In China, regulatory documents in various forms possess a hierarchical binding effect, collectively shaping the compliance framework for enterprises. Documents issued in the form of departmental rules carry legal enforceability. Violations of such rules may directly result in administrative penalties. Guidance documents – such as policy interpretations, FAQs, and typical case studies issued by authorities – do not in themselves create direct binding legal force. However, they articulate the official interpretation and prevailing enforcement priorities of the regulators, serving as critical reference materials for corporate compliance. 1.8 Enforcement Proceedings and Fines Investigations and Enforcement Actions When initiating administrative proceedings and enforcing the laws, the competent authorities must abide by the Law on Administrative Penalty ( 行政处罚 法 ). The competent authorities should conduct inves - tigations to ascertain the facts of the alleged violating acts before imposing punishment on anyone (Article 54). For triggers of investigations, refer to 1.7 Regula- tors . Regulators shall promptly notify the parties concerned of the facts of the violation and facilitate their submis - sion of statements and defences (Article 41). Gener - ally, the regulator shall make the administrative pen - alty decision within 90 days from the date of case filing (Article 60). Prior to rendering an administrative penalty decision, the regulator shall inform the parties of the proposed penalty and its legal basis (Article 44). The penalised parties are entitled to a hearing in cases where the administrative penalty involves the suspen - sion of business, rescission of a business permit or licence, or a large penalty (Article 63). If a party is dissatisfied with an administrative penalty, it has the right to apply for administrative reconsideration or file an administrative lawsuit (Article 7). Sanctions and Remedies The Three Fundamental Laws uniformly stipulate that any violation of the laws which causes damage to oth - ers shall bear civil liability. Where a crime is consti - tuted, criminal liability shall be imposed.
competent authorities. The MIIT, the MPS, the State Administration for Market Regulation (SAMR) and oth - er industry regulators are in charge of law enforcement in the respective industries. Typical Investigative Workflow Investigations initiated by regulators can be triggered in different ways, including: • reporting – where users may report to the regula - tors and consumer protection organisations, and investigations are launched accordingly; • regular and irregular inspections – where special projects that last several months are launched to target specific industries or pain points in cyber - space; and • inquiries into data leakage events, network loop - holes or other cybersecurity/data incidents. While conducting investigations, special rules shall be followed by the regulators. For instance, the Measures for Supervision and Inspection of Cyberspace Security by Public Security Organs (Draft for Comments) ( 公安机 关网络空间安全监督检查办法 ( 征求意见稿 )) prescribes the pro - cedures for law enforcement inspections conducted by public security organs. The Provisions on Admin - istrative Law Enforcement Procedures of Cyberspace Administration Departments ( 网信部门行政执法程序规定 ) set the rules to oversee the investigations initiated by the CAC. The MIIT must conduct its enforcement activities in accordance with the List of Administrative Law Enforcement Matters of the Ministry of Industry and Information Technology (2025 Edition) ( 工业和信息 化部行政执法事项清单 (2025 年版 )). Domestic and Cross-Border Co-Ordination Mechanism The CAC is in charge of overall planning with regard to data protection and privacy, and co-ordinates the competent authorities. A collaborative mechanism has been established among various departments for information sharing and case transfer. For instance, if the CAC or the industrial authority discovers any clues indicating criminal offences, they will transfer the case to the public security organs. There is no Chi - nese equivalent to GDPR “lead supervisory authority” mutual-recognition.
53 CHAMBERS.COM
Powered by FlippingBook