China DNSIP 2012

Decision of the Standing Committee of the National People's Congress concerning Strengthening Network Information Protection (2012) — NPC Standing Committee (National People's Congress of China)

Also known as: DNSIP, NPCSC Decision on Network Information Protection, Decision concerning Strengthening Network Information Protection

Official site Official change log Subscribe to China DNSIP 2012 (RSS)

Current version: NPC Standing Committee Decision on Strengthening Network Information Protection (2012); Published 28 December 2012. source
Status: In force
Next deadline: None announced
Who must comply: Network service providers and other enterprises and institutions that collect and use citizens' personal electronic information in their business, plus anyone sending commercial electronic messages. source

How it is assessed: Businesses apply the duties themselves: confidentiality, technical security measures and immediate remediation when information leaks or may leak. source
Authority: Adopted by the Standing Committee of the National People's Congress; the competent authorities enforce it within their respective remits (Article 10). source
Enforced by: Violations draw warnings, fines, confiscation, licence revocation, site closure and bans, recorded in social credit files; criminal and civil liability also apply. source
Last change: None recorded yet

The short decision that first put personal electronic information under statutory protection in China: collection only with consent and for a stated purpose, confidentiality and security duties on network service providers, real-name registration for users, and a right to demand deletion. Much of it was later absorbed by the Personal Information Protection Law, but it was never repealed, so it still sits in the statute index as law in force.

Recent changes

No changes recorded yet — we are watching, and nothing has been published.

Key dates

No upcoming dates

2012-12-28 Decision adopted by the NPC Standing Committee

Amendments

2012-12-28
NPC Standing Committee Decision on Strengthening Network Information Protection (2012) Major versionCurrent text

Adopted at the 30th session of the 11th NPC Standing Committee and in force from the date of its publication (Article 12). source

Who it applies to

Twelve articles protecting personal electronic information, binding network service providers and other businesses that collect it, and senders of commercial messages.

Collection and use: Network service providers and other enterprises and institutions must collect and use personal electronic information lawfully, properly and only as necessary, state the purpose, method and scope, and obtain consent (Article 2). source
Real-name registration: Providers of website access, fixed and mobile phone services or information publishing services must require users to provide true identity information (Article 6). source
Commercial messages: No one may send commercial electronic messages to phones or personal email without the recipient's consent or request, or after an explicit refusal (Article 7). source
Status: The CAC's list of laws still includes the Decision, alongside the Cybersecurity Law, the PIPL and the Data Security Law. source

How compliance is assessed

Businesses apply the duties themselves: confidentiality, technical security measures and immediate remediation when information leaks or may leak.

Confidentiality: Personal electronic information collected in business must be kept strictly confidential and not leaked, altered, damaged, sold or unlawfully provided (Article 3). source
Security measures: Take technical and other necessary measures to keep information secure, and take remedial measures immediately when it leaks or may leak (Article 4). source
Deletion requests: Citizens may require network service providers to delete information that discloses their identity or privacy or to stop commercial message harassment (Article 8). source

Enforcement and penalties

Violations draw warnings, fines, confiscation, licence revocation, site closure and bans, recorded in social credit files; criminal and civil liability also apply.

Administrative penalties: Warnings, fines, confiscation of unlawful gains, revocation of licences or filings, website closure and bans on responsible persons providing network services, recorded in social credit files and published (Article 11). source
Other liability: Public security penalties, criminal liability where a crime is committed, and civil liability for infringing others' rights (Article 11). source

Documents

Frequently asked questions

Is the 2012 NPC decision on network information protection still in force?

It remains on the CAC's list of laws next to the Cybersecurity Law, the PIPL and the Data Security Law. source

Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 19 September 2026. Subscribe to China DNSIP 2012 (RSS)

At a glance