On 1 November 2023 the Beijing Cyberspace Administration announced that, under Article 45(1) of the Data Security Law, it had penalised three companies for failing to perform data-security protection obligations. Each company received a correction order, a warning and a fine of RMB 50,000; the directly responsible managers and other responsible persons were each fined RMB 10,000.
The amounts are modest, but the structure of the penalty deserves attention. It pursues both the entity and individuals, turning data security from an abstract institutional requirement into a personal risk for managers.
The basis is the Data Security Law, not the Cybersecurity Law
The case applies Article 45(1) of the Data Security Law, which addresses failure to perform data-security protection obligations: for example, not establishing a full-process data-security management system, not adopting technical measures, not conducting risk assessments, or not taking remedial action after an incident.
This sits alongside the graded-protection obligations under the Cybersecurity Law and the processing rules under the Personal Information Protection Law. Companies often conflate the three, but enforcement authorities select the applicable provision according to the facts. Data classification, risk assessment and security management are independent requirements under the Data Security Law and cannot be replaced by “we have already done graded protection”.
Why individuals were fined too
The Data Security Law covers “directly responsible managers and other directly responsible persons”. Data security is therefore not solely a matter for the technology department: legal representatives, executives responsible for data, and business owners may all be found responsible.
The RMB 10,000 fine on individuals is small, but the signal is clear: where systems are missing, assessments are not performed or incidents are mishandled, the regulator can look past the company to the people who run it.
What the three cases have in common
The notice does not name the companies or describe the facts, but the provision applied points to failures in data-security protection. In practice, such findings usually correspond to the following:
First, no data classification inventory, so the company does not know which data is important or core. Second, no periodic risk assessment, or an assessment that is purely formal. Third, security policies that contain only principles, without owners, procedures or records. Fourth, failure to take timely remedial action or to keep records after an anomaly.
These gaps are common in smaller companies. Limited resources do not excuse them; they make exposure more likely.
A workable self-assessment checklist
First, inventory data assets by business system, data type, storage location and access subject, marking personal information, important data and sensitive data.
Second, assign responsibility. Define the roles of the data-security officer, business owners and technology owners, and write them into policy.
Third, conduct a risk assessment. The point is not to produce a document but to answer: if this data were leaked, altered or made unavailable, what would the impact be, and do current measures cover it?
Fourth, keep records. Training, drills, permission changes and incident handling should carry dates and owners. Inspectors look less at whether a policy exists than at whether it operates.
Fifth, bring suppliers into scope. Obligations of processors, cloud providers and outsourced teams should be secured through contracts and periodic checks.
For classification, risk assessment and policy development, see our data compliance service; for security management and incident response, see cybersecurity compliance; for management responsibility and ongoing support, see annual legal counsel.
This article is based on the notice published by the Beijing Cyberspace Administration on 1 November 2023. It is for reference only and does not constitute legal advice.