Civil Level

The protection of privacy in China is grounded primarily in the Civil Code of the People’s Republic of China, Article 1032 of which prohibits any organisation or individual from infringing upon another’s rights to privacy by prying into, intruding upon, disclosing or publicising other’s private matters. This Article also defines privacy as the private life of a natural person and their private space, private activities and private information that they do not want to be known to others.

The Civil Code also protects personal information, such as one’s name, ID number and contact details, and treats such private personal information as being subject to the right to privacy. Article 1034 of the Civil Code makes it clear that in the absence of a special provision on the protection of personal information, the provisions on the right to privacy shall apply. For the protection of personal information, see 4. Data Protection.

It should be noted that only natural persons can enjoy the right to privacy; legal persons and unincorporated organisations are not entitled to such right under Article 1032. However, legal persons and unincorporated organisations may still seek protection for their secret information through trade secret protection.

To establish a claim for the invasion of privacy, the claimant must generally show that:

• the information or matter at issue is private in nature;
• the defendant committed an act that infringes upon their privacy rights;
• the infringement was committed at fault; and
• the claimant suffered damages as a result of the violation.

Administrative/Criminal Level

From the perspective of administrative law, Article 50 of the Public Security Administration Punishments Law stipulates that peeping, secretly filming, eavesdropping or disseminating others’ private information are all punishable acts, which may result in administrative detention or fines.

Criminal law stipulates that the following severe violations of privacy can be considered as criminal offences:

• Article 245 of the Criminal Law – unlawful search of another person’s body or residence, or illegal intrusion into another’s residence;
• Article 252 of the Criminal Law – illegally concealing, destroying or opening others’ letters;
• Article 253 (1) of the Criminal Law – selling or providing personal information to others in violation of relevant provisions; and
• Article 284 of the Criminal Law – the unlawful use of any special equipment or devices for eavesdropping or covert photography.

Privacy is a subcategory of personality rights, so the remedies available for personality rights apply to privacy rights. In China, both damages and injunction relief are available.

Injunctions

Article 179 of the Civil Code generally stipulates that the main forms of civil liability include cessation of infringement, removal of the obstacles and elimination of danger. The victim can seek a court-issued injunction to prevent the continued or escalating damage to their privacy. If the content is online, this typically means a court will order deletion of the posts/articles or removal of the content from platforms. If the infringer is an individual who reveals another’s private information, the order would be to cease further publication or dissemination of such content.

Article 997 of the Civil Code further provides that where a civil subject has evidence proving that someone is committing or is about to commit an act infringing upon their personality rights, and such act may cause irreparable harm, they have the right to apply to the people’s court for an injunction to cease such conduct. This provision serves as a legal basis for interim or permanent injunctions in privacy cases, allowing victims to promptly prevent the dissemination of infringing statements even before substantial damage occurs. Personality rights include the right of reputation, which means that the victim can obtain an injunction before the publication of infringing content or during its dissemination.

Elimination of Impacts/Extensions of Apologies

Article 179 of the Civil Code stipulates that the elimination of adverse effects is a kind of remedy for civil liability. This means that the court can require the defendant to take measures to eliminate or mitigate the negative influence on the victim’s privacy. Apology is another kind of remedy available for civil liability. Such measures may include publishing a written apology letter on the same website where the infringing content appeared.

Damages

In principle, financial compensation aims to compensate the actual loss of the victim. Because privacy harm is intangible in most cases, courts usually award damages for emotional distress rather than financial loss. However, in certain circumstances, reasonable attorney and notary fees can be considered as financial losses and can thus be compensated. The amount of the damages varies, depending on the severity of harm in the case.

Deadlines

The statute of limitations for civil claims based on the right to privacy is three years. It starts from the date the right holder becomes aware or should have become aware of the infringement and the identity of the infringer, unless otherwise provided by law. However, if more than 20 years have passed since the infringing act occurred, the statute of limitations expires regardless of when the claimant became aware of it (Article 188 of the Civil Code). What is more, the deadlines only impact the monetary remedy – the claimant may still seek non-monetary remedies.

In China, the statute of limitations will not be examined by the court unless it is raised by the defendant. According to Article 193 of the Civil Code, courts are prohibited from invoking the statute of limitations ex officio.

Regarding criminal liability, the provisions on the statute of limitations are more complex, with the statute of limitations depending on the maximum sentence that can be imposed (Article 87 of the Criminal Law).

Defences

According to Article 999 of the Civil Code, where news reporting or public opinion supervision for public interest is involved, the defence of reasonable use may justify the use of a person’s name, image or personal information. However, the improper use of such information that infringes upon the personality rights of a civil subject shall give rise to civil liability. The abovementioned scope of reasonable use does not include “privacy”. Furthermore, unlike defamation, where “truth” can be used as a defence, the core of a privacy lawsuit lies in the unauthorised disclosure of private information, so defences focus on the legality of the interference.

Key defences include the following.

• Consent – the victim has consented to the disclosure or had previously made the information public voluntarily.
• Public – disclosed information is generally not considered as private information. However, if public information is used unethically, this may still constitute an infringement.
• Limited scope in news reporting/public opinion supervision – for individuals involved in public events of public concern, media coverage of their relevant information within necessary limits may not constitute a privacy infringement. However, disclosure of information that is purely gossip or sensational in nature still constitutes a privacy infringement.

Criminal or Civil Proceedings

The distinction between civil and criminal proceedings for defamation cases lies in the purposes. In civil proceedings, the primary objective is to recover damage to the claimant’s reputation and restore their social standing through legal remedies. In contrast, criminal proceedings are punitive in nature, aiming to punish the defendant for actions that harm social order and public morality by damaging reputation. Such lawsuits require a higher threshold of proof – the evidence must be beyond reasonable doubt.

Private or Anonymised Proceedings

In China, civil litigation is generally conducted in public by default. However, cases involving the right to privacy are an exception: such legal proceedings must be conducted in private.

Establishing Grounds

Generally, the claimant must prove to the court that the place where the tort occurred or the place of the defendant’s domicile is within its jurisdiction. The place where the tort occurred includes the place where the tort is committed and the place where the tort consequence occurred. For online torts, the location of information equipment including the computer used to commit the alleged tort is considered as the place where the tort occurred, while the victim’s domicile is considered the place where the consequence of the tort occurred.

Litigation costs mainly include the court fees for filing a lawsuit in the people’s court (“acceptance fee”) and other litigation costs, such as attorney fees. In Chinese civil litigation, the court acceptance fee is, in principle, borne by the losing party at the end but the claimant will need to advance such payment when filing the case at the beginning. Regarding litigation costs such as attorney fees, there is no general statutory rule mandating that the losing party must bear them, except under some specific circumstances, such as online infringement.

In judicial practice, a right-holder may claim that the reasonable expenses incurred in protecting their rights – including attorney fees, notary fees and investigation and evidence collection costs in accordance with the regulations of relevant national departments – constitute part of their losses. The right-holder can apply to the court to order the infringer to compensate for these costs. The court will review the necessity and reasonableness of such expenses, and will uphold the reasonable portion thereof.

There are no unusual features regarding privacy actions in China.

From the civil perspective, defamation is governed by a combination of statutory provisions in the Civil Code. Article 1165 generally states that anyone who infringes upon another’s personality rights due to fault shall bear civil liability. Article 1024 of the Civil Code explicitly defines reputation as a personality right and stipulates that no organisation or individual may infringe upon a citizen’s right to reputation through defamation, slander or other means.

Articles 1025–1029 of the Civil Code cover the protection of the right to reputation in specific circumstances, including:

• news reporting and public opinion supervision for public interests;
• the publication of literary and artistic works depicting real people and events; and
• false reporting in newspapers, networks and other media.

In addition, companies can invoke Article 11 of the Anti-Unfair Competition Law (AUCL) to protect their reputation; this Article specifically forbids business operators from fabricating or disseminating false or misleading information to damage the business or product reputations of competitors.

In terms of criminal law, Article 246 of the PRC Criminal Law criminalises defamation (including slander or libel) if the circumstances are serious. Such lawsuit must be filed by the victim, unless the case has a serious public impact. Article 221 of the Criminal Law stipulates that anyone who disseminates false information that damages a company’s commercial reputation or commodity reputation, causing serious consequence, constitutes a crime.

To file a lawsuit, the claimant must show:

• a defamatory act by the defendant, typically a false statement of fact or an abusive insult that has been disseminated to a third party;
• the publicity of the act;
• that a reasonable person, after reading all the content, could reasonably infer that the specific direction or intention indicated the victim;
• damage to reputation – ie, the statement has caused or is likely to cause a decline in the plaintiff’s social standing; and
• causation and fault – the damage resulted from the defendant’s conduct, and the defendant acted intentionally or negligently.

Injunctions

Please see 1.2 Privacy Remedies (Injunctions), which applies to defamation mutatis mutandis. Article 179 of the Civil Code also provides for the restoration of reputation as a remedy in defamation cases.

Elimination of Impacts/Extensions of Apologies

Please see 1.2 Privacy Remedies (Elimination of Impacts/Extensions of Apologies), which applies to defamation mutatis mutandis.

In practice, these two remedies often overlap because, by apologising, the victim’s reputation may also be restored. The claimant typically seeks both remedies simultaneously.

Damages

Damages include damages for economic loss and mental distress. For example, loss of customers for a company or loss of employment for an individual constitute economic losses. Damages for mental distress refer to humiliation, anxiety or emotional harm suffered by the victim because of the perpetrator. The damages for mental distress apply only to natural persons, with the normal range of compensation varying from CNY2,000 to CNY50,000 or even higher, depending on the severity of infringement in the case.

Deadlines

The statute of limitations for civil litigation is the same as that outlined in 1.3 Privacy Deadlines and Defences (Deadlines).

Defences

• Truthfulness – the most straightforward defence is the truthfulness (substantial truthfulness) of the statements. However, if the content contains insulting words, the defendant may still be liable for defamation even if the factual basis is true.
• Public interest – if the statement is made when reporting news or conducting public opinions supervision or the like for public interest purposes, the defendant may invoke this as a defence. The defendant must prove that:
1. they have not fabricated or distorted the facts;
2. they have reasonably verified the information; and
3. they did not use insulting words, etc (Article 1025 of the Civil Code).
• No depiction – if the statement does not identify or depict a specific individual, the defendant cannot be held liable for defamation (Article 1027of the Civil Code). However, the trend of online defamation is evolving quickly, and the infringer may avoid “direct depiction” and start to use “sarcastic or insinuating remarks” to induce the public to form an unfavourable impression, which will still constitute defamation.

Criminal or Civil proceedings

See 1.4 Privacy Proceeding Forum Choice (Criminal or Civil Proceedings).

Private or Anonymised Proceedings

Unlike privacy proceedings, defamation proceedings are generally not conducted privately or anonymously. However, if private matters are also involved, a private or anonymised proceeding may be chosen.

Establishing Grounds

See 1.4 Privacy Proceeding Forum Choice (Establishing Grounds).

See 1.5 Privacy Costs.

There are no unusual features regarding defamation actions in China.

Civil Level

Chinese law does not have a single unified statute for “harassment” in the way that some common law jurisdictions do. Instead, provisions prohibiting harassment are scattered throughout various legal articles. For example, Article 1101 of the Civil Code regulates sexual harassment, and Article 1033 of the Civil Code explicitly lists “intruding upon another person’s private life through making phone calls, sending text messages, using instant messaging tools, sending emails and flyers” as an infringement of privacy rights.

Administrative Level

The Public Security Administration Punishments Law provides administrative penalties for some harassment-like behaviour, such as sending obscene, insulting or threatening messages repeatedly or interfering with another’s normal life through harassment, pestering or stalking. For cyberbullying and online harassment, the Cyberspace Administration of China (CAC) has issued a regulation called “Regulations on the Governance of Cyberviolence Information”, which contains several provisions aimed at preventing and addressing cyberviolence, including online harassment.

Criminal Level

Article 293 of the Criminal Law (Crime of Picking Quarrels and Provoking Troubles) is a catch-all clause that has been used to punish persistent harassment that causes a public disturbance, among other things.

There are no specific civil remedies for harassment under current Chinese law. Instead, civil remedies for harassment may be sought under general tort provisions, as explained in 1.2 Privacy Remedies. For administrative remedies, the police can issue a warning, fine or detention to the perpetrator.

For damages, please see 2.2 Defamation Remedies.

The limitation period for civil action is the same as that outlined in 1.3 Privacy Deadlines and Defences (Deadlines). However, harassment is usually a continuous or recurring tort. If harassment continues, a claimant can argue that the statute of limitation only begins to run after the harassment ceases (the principle of continuing tort). There are no specific statutes of limitations for harassment suits.

See 1.4 Privacy Proceedings Forum Choice, which also applies to harassment proceedings. Whether the proceedings can be anonymised depends on whether privacy issues are involved.

See 1.5 Privacy Costs.

The legal framework for data rights protection in China is centred on several specialised laws, with detailed implementation through administrative regulations. The primary legal bases include:

• the Personal Information Protection Law of the People’s Republic of China (PIPL), which focuses on safeguarding the personal information rights and interests of natural persons, establishes the “informed consent”-based rules for personal information processing, and clarifies the rights of data subjects in processing activities;
• the Data Security Law of the People’s Republic of China (DSL), which emphasises ensuring data security and promoting the development and utilisation of data, establishes a data classification and hierarchical protection system, and implements heightened protection for important data and core data;
• the Cybersecurity Law of the People’s Republic of China (CSL), which serves as the foundational law for cyberspace security management and provides basic provisions for network data security;
• the Network Data Security Management Regulations, which took effect on 1 January 2025 and serve as key administrative regulations that systematically integrate and elaborate on the requirements of the aforementioned laws, becoming the primary operational basis for regulating network data processing activities; and for individuals, at the level of fundamental civil rights, the Civil Code of the People’s Republic of China also explicitly stipulates the protection of privacy rights and personal information by law, as detailed in 1.1 Privacy Grounds.

Remedies and sanctions can be categorised into three main types.

• Civil remedies: victims may file a lawsuit with the court, demanding the infringer to bear liabilities such as ceasing the infringement, eliminating the adverse effects, offering apologies and compensating for losses. Compensation for losses includes compensation for actual property losses and, in cases of severe mental harm, compensation for mental distress. In judicial practice, the amount of damages for mental distress is determined at the court’s discretion, typically ranging from several thousand to several hundreds of thousands of yuan.
• Administrative sanctions: regulatory authorities may, in accordance with the law, take measures against violators such as ordering rectification, issuing warnings, confiscating illegal gains, imposing fines, suspending relevant operations or revoking licences. Fines can be substantial; for instance, an entity that illegally processes personal information may face a fine of up to CNY50 million or 5% of its turnover from the previous financial year.
• Criminal penalties: if an unlawful act constitutes a crime (eg, Infringing upon Citizens’ Personal Information), criminal liability shall be pursued according to the law, which may result in penalties including fixed-term imprisonment, criminal detention and fines.

Deadlines

The deadlines for bringing a data protection action are the same as the statute of limitations detailed in 1.3 Privacy Deadlines and Defences (Deadlines).

Defences

Data handlers (equivalent to data controllers under the GDPR) can rely on the following key defences.

• Lawful basis:
1. having obtained the data subject’s separate and explicit consent;
2. the processing is necessary for the conclusion or performance of a contract to which the data subject is a party; or
3. the processing is necessary for the performance of a statutory duty or obligation.
• Nature of the data: the data used is anonymised information (where specific individuals cannot be identified and the information cannot be restored), or constitutes reasonable use of lawfully disclosed information.
• Harmless consequence: the data processing activity has not caused substantial interference or damage to the legitimate rights and interests of the original rights holder.
• Fulfilment of security obligations: having promptly taken remedial measures and fulfilled notification obligations upon the occurrence of a security incident may be considered as a factor mitigating liability.

The data trustee (equivalent to the data processor under the GDPR) may assert that the data is processed within the methods, purposes and scope specified by the data handler.

Under Chinese law, civil and criminal lawsuits arising from the infringement of data rights differ fundamentally.

Civil lawsuits primarily provide remedies for infringed civil rights and interests. Their core basis lies in laws such as the Civil Code and the PIPL, targeting acts like the unlawful processing of personal information and the infringement of privacy rights. Civil lawsuits are filed by the victimised individual or organisations as the claimant, aiming to obtain remedies such as an injunction to stop the infringement and compensation for damages. While the principle of “whoever asserts must prove” generally applies in such lawsuits, the principle of presumed fault applies in personal information infringement cases, meaning that the defendant (the data handler) bears the burden of proving the absence of fault.

Criminal prosecution, on the other hand, aims to punish criminal acts. Its regulatory scope is broader, targeting not only the crime of “Infringing upon Citizens’ Personal Information” but also crimes that endanger data security and computer system order, such as the crime of “Illegally Obtaining Computer Information System Data”. The objects of these crimes are not limited to personal information but also include corporate data, etc. Such cases are typically investigated by public security organs and prosecuted by the People’s Procuratorates.

At the procedural level, the standard of proof in civil litigation is “high probability”, whereas criminal prosecution must meet the stricter standard of “beyond a reasonable doubt”. In both civil and criminal proceedings, cases involving personal privacy can be heard in private as stipulated by law, although completely anonymous trials are not yet widely implemented in China. Initiating a civil lawsuit requires the conditions stipulated in the Civil Procedure Law to be met, including the claimant having a direct interest in the case, a clearly identified defendant, specific claims, and factual and legal grounds.

Jurisdiction usually belongs to the people’s court in the place of the defendant’s domicile or the place where the tort occurred (including both the place where the act was committed and where its consequences occurred).

See 1.5 Privacy Costs.

National broadcasters and newspapers in China place great emphasis on privacy, accuracy and journalistic ethics. National broadcasters are always seen as authoritative sources of information, and they bear significant social responsibility.

The most influential news providers in China are Xinhua News Agency, People’s Daily, China Media Group, Guangming Daily and China Daily.

In China, broadcasting, the press, other publishers and online/social media are regulated by different regulations based on their roles. These regulations include:

• the Regulations on the Administration of Radio and Television (last revised on 6 December 2024);
• the Administrative Regulations of Publications (last revised on 6 December 2024);
• the Regulations on the Administration of Internet News Information Services (issued on 2 May 2017);
• the Administrative Measures on Internet Information Services (last revised on 6 December 2024); and
• the Provisional Measures for the Administration of Artificial Intelligence Services (issued on 10 July 2023).

Effectiveness of Regulators

Regulators are primarily concerned with the authenticity of the content and the impacts of its dissemination, thereby reducing defamatory information in official media. With the development of the internet and the enforcement of the PIPL, the CAC becomes the most important regulator of information on the internet. The CAC has published several provisions relating to the protection of privacy and reputation, especially for information generated by using AI.

Media Protection

There are no specific laws especially to protect the media. However, some rules can be used as defence for media outlets when conducting news reporting. For example, Article 1025 of the Civil Code stipulates that conduct related to news reporting or public opinion supervision may bear mitigated or exempted liability if it reasonably affects the legitimate rights and interests of others, provided such conduct:

• is conducted for the public good and is not fabricating or distorting the facts;
• does not fail to fulfil its obligation of reasonable verification of seriously inaccurate contents provided by others; and
• does not use insulting words to belittle the reputation of others.

This provision can provide protection for media outlets when they report news.

Article 1028 of the Civil Code provides that anyone who has evidence proving that the content reported by newspapers, periodicals or websites is untrue and thus infringes upon his or her reputation has the right to request the media outlet to take necessary measures, including correcting or deleting the content in a timely manner. If the media outlet fails to respond in a timely manner, it will bear corresponding civil liability.

For information online, the CAC establishes a complaint platform called 12377 for anyone who believes that information on a website was involved in privacy leaking, defamation, insulting, etc. The platform will forward the complaints to the local Cyberspace Administration or directly to the website to handle it. In most cases, the relevant information will be deleted. If the consequences are serious, the CAC will order the website to suspend or delete the relevant social media accounts and issue warnings and/or fines to the relevant persons.

Articles 1195–1197 of the Civil Code establish China’s “safe harbour” rules, which are very similar to the safe harbour provisions in the Digital Millennium Copyright Act and the E-Commerce Directive. Initially, the safe harbour rule primarily dealt with copyright issues related to user-generated content hosted on websites, but it can now be applied to all civil rights.

According to these provisions, websites that host user-generated information are held liable when:

• after receiving a notice from the right-holder, they fail to take necessary measures such as deletion, blocking or disconnection of links in a timely manner (notice-and-takedown mechanism); or
• they know or should have known about the infringing content but fail to take necessary measures.

In other words, websites will not be liable for user-generated information if they take necessary measures after they receive a notice from the right-holder or after they know or should have known about the infringing content.

The concept of SLAPPs does not exist under current Chinese law. Therefore, there are no legal or regulatory mechanisms to prevent SLAPPs.

China has no specific law prohibiting the enforcement of judgments from other jurisdictions in media cases. The enforcement of these judgments in China follows the general rules for the recognition and enforcement of foreign judgments.