Didi fined RMB 8.026 billion by the CAC over 16 findings, with RMB 1 million each on its chairman and president
Subject: Didi Global Inc.
What happened
In July 2021, to guard against national data security risk, safeguard national security and protect the public interest, the Cybersecurity Review Office opened a cybersecurity review of Didi under the National Security Law, the Cybersecurity Law and the Measures for Cybersecurity Review. Based on the review conclusions and the problems and leads it uncovered, the Cyberspace Administration of China opened a case investigation into the suspected violations.
How it was handled
The investigation established 16 unlawful facts grouped into eight categories: unlawfully collecting 11.9639 million screenshots from users’ phone albums; excessively collecting 8.323 billion items of clipboard and installed-application data; excessively collecting 107 million facial recognition records, 53.5092 million age-bracket records, 16.3356 million occupation records, 1.3829 million family-relationship records and 153 million "home" and "work" pick-up addresses of passengers; excessively collecting 167 million precise location (latitude/longitude) records in specific scenarios; excessively collecting 142,900 driver education records and storing 57.8026 million driver ID numbers in plaintext; analysing 53.976 billion travel-intent records, 1.538 billion habitual-city records and 304 million out-of-town business/travel records without clearly informing passengers; repeatedly requesting irrelevant phone permissions during carpooling; and failing to accurately and clearly explain the processing purposes for 19 categories of personal information including device data. The cybersecurity review also found data processing activities seriously affecting national security and conduct maliciously evading supervision, which is not disclosed as it concerns national security. The violations began as early as June 2015 and lasted about seven years; 64.709 billion items of personal information were unlawfully processed.
Outcome
On 21 July 2022 the CAC, applying the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law and the Administrative Penalty Law, fined Didi Global Inc. RMB 8.026 billion and fined chairman and CEO Cheng Wei and president Liu Qing RMB 1 million each. In its Q&A the CAC set out five grounds for the severity: the nature of the conduct, its duration, its harm, the volume of personal information unlawfully processed, and the range of violation types across multiple apps.
What it means for Chinese exporters
- · Overseas listing and data compliance are the same risk chain. This case began with a cybersecurity review triggered by a US listing and ended in the largest personal-information fine on record. Chinese AI companies planning an overseas listing should complete data classification and grading, important-data identification and outbound-transfer path assessment when listing preparation starts, not when the exchange sends its first query.
- · "Excessive collection" is quantified item by item. Conveniently available data — clipboard contents, installed-app lists, album screenshots, precise location — is counted record by record and treated as an aggravating factor. Product teams need a permission- and field-level necessity ledger: each collection point mapped to a business function and a written necessity justification.
- · Inferred data that is not clearly disclosed is equally unlawful. Labels derived from raw data — travel intent, habitual city, out-of-town business or travel — need their own purpose notice and cannot hide behind "to improve our services". This is especially dangerous for AI companies doing user profiling and recommendation.
- · How sensitive personal information is stored is inspected directly. Storing ID numbers in plaintext was listed as a standalone finding — encryption at rest, key separation and access auditing should be the minimum standard for sensitive fields.
- · Responsibility lands on named individuals. The chairman and president were fined separately, which shows that "compliance is legal’s problem" does not hold in Chinese enforcement practice; the decision records of the data security committee and the personal information protection officer must show that they discharged their oversight duty.
Related regulations
Sources (2)
- CAC administrative penalty decision against Didi Global Inc. following the cybersecurity reviewCyberspace Administration of China (CAC) · published 2022-07-21 · retrieved 2026-09-12
- CAC official Q&A on the administrative penalty decision against Didi Global Inc.Cyberspace Administration of China (CAC) · published 2022-07-21 · retrieved 2026-09-12
Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.