CAC Standardizes Penalty Discretion to Guide Digital Businesses
ISSUING AUTHORITY:
Cyberspace Administration of China
DATE OF ISSUANCE:
June 27, 2025
EFFECTIVE DATE:
August 1, 2025
On June 27, 2025, the Cyberspace Administration of China issued the Rules on Application of Administrative Penalty Discretion Benchmarks (the “Rules”), effective on August 1, 2025, to unify enforcement standards and safeguard stakeholders’ rights.
The Rules define administrative penalty discretion benchmarks as refined, quantifiable enforcement standards, taking into account factors such as the facts, severity, social harm, and intent of a violation. In applying these benchmarks, authorities must uphold the principles of consistency, fairness, and impartiality, ensuring that penalties serve both punitive and educational purposes.
The Rules classify penalties into five tiers, including exemption, mitigation, leniency, standard, and severity based on violation severity and intent. The Rules also set compliance boundaries for data processing and cybersecurity, requiring localized benchmarks tailored to regional needs under hierarchical supervision. Furthermore, higher-level authorities will oversee localized benchmarks through inspections and case reviews to ensure consistency across jurisdictions. This enhances legal predictability for cross-border data flows and algorithmic governance, supporting Personal Information Protection Law and Data Security Law implementation.
Reference:
