business permits or business license; and the directly responsible officers and other persons directly liable
shall be imposed a fine of no less than CNY50,000 but no more than CNY200,000.
Those who violate the management system for core data of the State and cause harm to the national
sovereignty, security and development interests shall be imposed a fine of no less than CNY2 million but no
more than CNY10 million by relevant competent departments, and shall be ordered to suspend relevant
business or stop operation for rectification, or be subject to revocation of relevant business permits or
business license, as appropriate; if a crime is constituted, they shall be held criminally liable in accordance
with the law.
Article 46 Those who provide any important data to a party outside the territory of the People's Republic of
China in violation of Article 31 hereof shall be ordered to make correction and given warnings by relevant
competent departments, and may be imposed a fine of no less than CNY100,000 but no more than CNY1
million concurrently; the directly responsible officers and other persons directly liable may be imposed a fine
of no less than CNY10,000 but no more than CNY100,000. In case of serious circumstances, they shall be
imposed a fine of no less than CNY1 million but no more than CNY 10 million, and may be ordered to
suspend relevant business or stop operation for rectification, or be subject to revocation of relevant business
permits or business license; the directly responsible officers and other persons directly liable shall be
imposed a fine of no less than CNY100,000 but no more than CNY1 million.
Article 47 Where any data transaction intermediary organization fails to perform the obligations stipulated in
Article 33 hereof, relevant competent departments shall order it to make correction, confiscate any illegal
income, and impose a fine of no less than one but no more than ten times the illegal income; where there is
no illegal income or the illegal income is less than CNY100,000, a fine of no less than CNY100,000 but no
more than CNY1 million shall be imposed, and the relevant competent departments may order such
organization to suspend relevant businesses, stop its operation for rectification, or revoke the relevant
business permits or business licenses; the directly responsible officers and other persons directly liable shall
be imposed a fine of no less than CNY10,000 but no more than CNY100,000.
Article 48 Those who refuse to cooperate in data access in violation of Article 35 hereof shall be ordered to
make correction and given warnings and may be imposed a fine of no less than CNY50,000 but no more than
CNY500,000 concurrently by relevant competent departments; their directly responsible officers and other
persons directly liable shall be imposed a fine of no less than CNY10,000 but no more than CNY100,000.
Those who provide any data to any foreign judicial or law enforcement body without approval of competent
departments in violation of Article 36 hereof shall be given warnings, and may be imposed a fine of no less
than CNY100,000 but no more than CNY1 million concurrently by relevant competent departments; their
directly responsible officers and other persons directly liable may be imposed a fine of no less than
CNY10,000 but no more than CNY100,000. In case of serious consequences, they shall be imposed a fine of
no less than CNY1 million but no more than CNY5 million, and may be ordered to suspend relevant business
or stop operation for rectification, or be subject to revocation of relevant business permits or business
license; their directly responsible officers and other persons directly liable shall be imposed a fine of no less
than CNY50,000 but no more than CNY500,000.
Article 49 Where any state organ fails to perform its data security protection obligations provided for herein,
the directly responsible officers and other persons directly liable shall be sanctioned in accordance with the
law.
Article 50 Where any government functionary with the duties of overseeing data security neglects his or her
duties, abuses his or her powers, or engages in malpractice for selfish ends, he or she shall be sanctioned in
accordance with the law.
Article 51 Any act of stealing or illegally obtaining data, and any data handling activity that excludes or
7