Regulation of Neural Data Privacy Protection in China

1. Introduction

Neural data privacy protection in China concerns the legal protection of information generated by or extracted from the human nervous system through technologies such as brain–computer interfaces (BCIs), electroencephalography (EEG), functional magnetic resonance imaging (fMRI), neural implants and other neurotechnological devices. Such information may reveal a person's cognitive processes, emotional responses, mental states, health conditions and behavioural tendencies.

China does not yet have a comprehensive, standalone statute specifically regulating neural data privacy. Instead, neural information is protected principally through the Personal Information Protection Law (PIPL) 2021, the Civil Code 2020, the Cybersecurity Law 2016, the Data Security Law 2021 and applicable medical-research and ethics requirements. These laws provide general safeguards, but their application to neural data presents unresolved legal questions.

Oxford Academic

+1

An important distinction must be drawn between established law and judicial precedent. Chinese courts have developed relevant principles concerning biometric information, personal information and privacy, but the leading facial-recognition cases are analogies for neural data protection rather than direct judgments on brain–computer interface data.

2. Statutory framework

A. Personal Information Protection Law, 2021

The PIPL is the central statute governing the processing of personal information by organisations and individuals in circumstances covered by the law.

Article 4 broadly defines personal information as information relating to identified or identifiable natural persons recorded electronically or by other means, excluding anonymised information. Neural recordings connected to an identifiable individual therefore generally fall within its scope.

Article 28 defines sensitive personal information to include information that, once leaked or illegally used, may easily harm personal dignity or endanger personal or property security. Its examples include biometric identification, medical and health information, financial accounts and location tracking, as well as information concerning minors under fourteen.

Although neural data is not expressly listed, neural data capable of revealing health conditions, mental states or intimate cognitive information can reasonably be classified as sensitive personal information, depending on its nature, identifiability and potential consequences of misuse.

Article 29 requires separate consent for processing sensitive personal information, subject to applicable statutory exceptions. Article 30 requires notification of the necessity of processing and its impact on individual rights and interests. Article 28 also requires a specific purpose and sufficient necessity, together with strict protective measures.

Article 55 requires a personal information protection impact assessment in specified circumstances, including processing sensitive personal information. Article 56 addresses documentation of such assessments.

For BCI developers, hospitals and neuroscience research institutions, these requirements can necessitate clear disclosures, appropriate consent mechanisms, access controls, security measures and documented assessments of privacy risks.

B. Civil Code of China, 2020

The Civil Code supplies the private-law foundation for neural privacy protection.

Article 1032: Recognises the right to privacy and prohibits unlawful intrusion into private life, disclosure of private information and other privacy violations.

Article 1034: Protects personal information and expressly recognises biometric information and medical health information among its examples.

Article 1035: Establishes principles governing personal-information processing, including legality, legitimacy, necessity and consent, subject to legal exceptions.

Article 1038: Restricts unlawful disclosure and provision of personal information and requires appropriate security measures.

Article 1039: Imposes confidentiality obligations on state organs and their staff concerning personal information acquired in performing their duties.

These provisions are relevant where neural recordings disclose intimate thoughts, psychological conditions or other information belonging to a person's private sphere. Civil remedies may include cessation of infringement, removal of information, elimination of effects, an apology and compensation where legally justified.

C. Cybersecurity Law and Data Security Law

The Cybersecurity Law 2016 establishes network-security obligations, while the Data Security Law 2021 regulates data-handling activities and associated security risks. Together with the PIPL, these laws support requirements for secure storage, restricted access, incident response and appropriate organisational safeguards.

Article 29 of the Data Security Law requires data-handling activities to strengthen risk monitoring and take remedial measures when security risks or data leaks arise. Article 57 of the PIPL addresses notification and remedial obligations when personal information is breached, tampered with or lost.

DigiChina

+1

3. Consent and protection in neural-data processing

Consent is particularly important when neural data is collected for clinical treatment, research, commercial applications or consumer neurotechnology.

For example, a company manufacturing an EEG-based concentration-monitoring headset may collect brain signals to measure attention. If it subsequently uses those recordings to infer emotional vulnerability and sell targeted advertising, the additional processing raises questions of purpose limitation, necessity, transparency and consent.

The PIPL's requirements cannot be satisfied merely by placing a broad authorisation in lengthy terms and conditions. The controller must establish an applicable legal basis and comply with the relevant rules for sensitive personal information.

Practical safeguards should include:

Explaining what neural signals are collected and what inferences may be generated.

Obtaining separate consent where Article 29 requires it.

Limiting collection and retention to justified purposes.

Restricting secondary use and third-party disclosure.

Using encryption, pseudonymisation and role-based access controls.

Conducting privacy impact assessments before relevant high-risk processing.

Where neural data is used in medical research, applicable medical-research ethics rules and clinical-trial requirements may impose additional safeguards. Consent to participate in a medical study should not automatically be treated as unlimited permission for commercial reuse.

4. Relevant judicial decisions

There is no established, directly analogous Chinese appellate precedent specifically deciding a neural-data privacy claim involving a brain–computer interface in the authorities discussed here. The following cases nevertheless provide useful legal principles.

A. Guo Bing v. Hangzhou Safari Park (2021)

In this widely discussed facial-recognition dispute, Guo Bing challenged a wildlife park's change from fingerprint-based entry arrangements to facial recognition.

The Hangzhou Intermediate People's Court held that the park's unilateral change breached its contractual obligations and ordered deletion of facial information, including the photograph submitted when purchasing the annual pass. The judgment also addressed deletion of fingerprint information.

sdcourt.gov.cn

+1

Legal significance: The decision demonstrates that collecting information for one purpose does not automatically authorise its conversion or use for another purpose. By analogy, collecting neural data for rehabilitation would not itself authorise using it to profile a patient's personality for advertising.

B. Supreme People's Court Facial-Recognition Judicial Interpretation (2021)

The Supreme People's Court issued its Provisions on Several Issues on the Application of Law in Hearing Civil Cases Related to the Use of Facial Recognition Technology to Handle Personal Information, effective 1 August 2021.

The interpretation identifies circumstances that may constitute infringement of personality rights, including failure to disclose processing rules, failure to obtain required separate consent, processing beyond agreed purposes, inadequate security and unlawful provision of facial information to others. It also addresses deletion requests and invalid contractual terms.

中华人民共和国最高人民法院

+1

Legal significance: Although facial recognition and neural recording are technologically distinct, the interpretation supports a broader principle: sensitive data processing must respect lawful purposes, appropriate consent, necessity and individual rights. The interpretation does not directly establish a special neural-data regime.

C. Criminal enforcement concerning facial-recognition data (2025)

In June 2025, China's Supreme People's Court highlighted illustrative cases involving illegal acquisition, sale and misuse of facial-recognition data. One reported case concerned the purchase and resale of facial images and software used to bypass facial-recognition systems.

Supreme People's Court

Legal significance: Such enforcement illustrates that unlawful handling of sensitive personal information can have criminal consequences where statutory offences are satisfied. Similar liability for neural-data misuse would depend on the conduct and applicable criminal-law provisions; it cannot be assumed solely because neural information was compromised.

5. Regulatory challenges and reforms

The principal difficulty is that neural data can disclose information beyond ordinary identity or medical records. It may enable inferences about attention, emotional responses and cognitive states, including information that individuals have not expressly communicated.

Chinese scholarship has therefore argued for expressly classifying neural personal information as sensitive personal information and developing more specific safeguards for neurotechnology.

Oxford Academic

+1

Potential reforms include defining neural data in legislation, requiring enhanced consent for mental-state inference, regulating commercial secondary use, establishing special protections for implanted devices and minors, and clarifying deletion and liability rules for derived neural profiles.

6. Conclusion

China's neural-data privacy framework currently rests on general personal-information, privacy, cybersecurity and data-security legislation. The PIPL provides the central safeguards, while the Civil Code supports civil claims for unlawful interference with privacy and personal-information rights.

The Guo Bing litigation and facial-recognition judicial interpretation provide useful analogies concerning consent, purpose limitation and deletion. However, the absence of a comprehensive neural-data statute and directly applicable neural-data case law leaves important questions unresolved. Effective protection will depend on applying existing law to the specific risks of neurotechnology while developing clearer rules for neural information and cognitive privacy.