Whistleblowing in China: The Regulatory Framework

Whistleblowing in China does not have a single, overarching law. Instead, obligations and protections relating to internal reporting and speak-up culture are distributed across a framework of sector-specific regulations, corporate governance standards, and data protection legislation.

That speak up framework has been developing rapidly. Since 2021, new laws governing personal information protection, data security, and cross-border data transfer have significantly changed how organisations operating in China must handle the data that flows through a whistleblowing programme. Understanding both the corporate governance and data protection dimensions is now essential for any multinational with operations in the People’s Republic of China.

The Legislative Foundation: No Single Whistleblowing Law

There is no overarching piece of legislation in China that comprehensively protects whistleblowers in the way that, for example, the EU Whistleblowing Directive or the UK’s Public Interest Disclosure Act (PIDA) does. However, a number of laws and regulations contain provisions that are relevant to whistleblowing, either by protecting the identity of those who report, by requiring organisations to establish reporting mechanisms, or by creating obligations around the handling of information disclosed through those mechanisms.

The most relevant instruments are:

• the Basic Rules for Enterprise Internal Control (2008), which first formally incorporated the concept of whistleblowing into Chinese corporate governance law, requiring listed companies to establish internal reporting and whistleblower protection mechanisms including hotlines and clear handling procedures
• the Measures for the Compliance Management of Central Enterprises (2022), which require centrally administered state-owned enterprises to establish a whistleblowing platform and announce a telephone number, email address, or postal address for that purpose
• the Civil Code of the People’s Republic of China (2020), which provides general protections for personal information and prohibits the unlawful disclosure of an individual’s private information
• the Criminal Law of the People’s Republic of China, which creates criminal liability for the infringement of citizens’ personal information, including where a whistleblower’s identity is unlawfully disclosed
• the Personal Information Protection Law (PIPL, effective November 2021), which governs how personal data – including data generated through a whistleblowing programme – must be collected, handled, protected, and transferred

Who Is Required to Have a Whistleblowing System?

The obligation to establish a formal whistleblowing system applies primarily to two categories of organisation:

• Centrally administered state-owned enterprises – that is, enterprises ultimately controlled by the central government of China and supervised by the State-owned Assets Supervision and Administration Commission (SASAC). These entities are required by the 2022 Measures to establish a whistleblowing platform and maintain it in working order. Failure to do so may result in SASAC requiring rectification, and where the failure causes loss to the enterprise, further regulatory steps may follow.
• Domestic listed companies – that is, companies listed on Chinese stock exchanges, which are required by the Basic Rules for Enterprise Internal Control (2008) to establish whistleblowing hotlines and clear procedures for handling disclosures.

Non-listed large and medium-sized enterprises are strongly recommended to establish a whistleblowing system, though this falls short of a legal mandate. For non-listed large and medium enterprises, best practice guidance strongly encourages adoption.

Foreign-invested enterprises (FIEs) – typically structured as limited liability companies in China – are generally not obliged under Chinese domestic law to establish a whistleblowing system. However, FIEs operating as subsidiaries of multinational groups may be required to implement a whistleblowing programme by the compliance requirements of their parent group – for example, where the parent is subject to the EU Whistleblowing Directive or listed on a stock exchange with its own speak-up policy requirements.

What a Whistleblowing Platform Must Include

Under the Basic Rules and the 2022 Measures, organisations that are required to maintain a whistleblowing system must ensure it includes:

• a clearly communicated reporting channel – a telephone hotline, email address, or postal address – that is announced to all relevant staff
• clear procedures for receiving, assessing, and handling disclosures
• measures to protect the identity of those who report
• effective communication of the system to all staff and, where appropriate, third parties

There is no prohibition in Chinese law against appointing an external body to operate a whistleblowing system. External operation of a reporting channel is explicitly contemplated in the Guidelines for Enterprises on the Compliance Management of Overseas Operations, and is increasingly common practice among larger organisations operating in China.

Protections pour les lanceurs d'alerte

While China does not have an employment-specific whistleblower protection law comparable to those in Western jurisdictions, a number of protections do exist in practice:

• The Civil Code and the Criminal Law both protect the personal information of individuals. Unlawful disclosure of a whistleblower’s identity may constitute a criminal offence – the Crime of Infringement upon Citizens’ Personal Information – as well as giving rise to civil liability.
• The Constitution of the People’s Republic of China and the Criminal Procedure Law both affirm the right of any entity or individual to report illegal actions. These provisions afford a degree of constitutional legitimacy to the act of reporting.
• Under the 2022 Measures, whistleblower information held by a centrally administered enterprise must be kept confidential. Retaliation against employees who report in good faith is prohibited, though the practical enforcement of this varies across organisations.

It is important to note that whistleblower protection under Chinese law is not absolute. Disclosure of a reporter’s identity may be required in certain legal proceedings, or where national security or significant public safety interests are at stake. Organisations operating in China should be transparent with reporters about these limitations.

Financial Rewards for Whistleblowers

China operates a financial rewards system for those who report certain categories of violation to the relevant regulatory authorities. Key developments include:

• The Interim Measures for Reporting and Rewarding Major Violations in the Field of Market Regulation (effective December 2021), jointly issued by SAMR and the Ministry of Finance (MOF), which allow financial rewards for reports of significant regulatory violations. Only natural persons – not legal entities – are eligible for rewards under these Measures.
• The Notice on Rewarding Internal Whistleblowers for Reporting on the Quality and Safety Issues of Drugs and Medical Devices (effective 29 May 2025), jointly issued by the National Medical Products Administration, SAMR, and MOF, which introduced financial rewards specifically for reports of quality and safety violations in the pharmaceutical sector.
• The Provisions for Awarding Whistleblowers of Illegal Securities and Futures Activities (effective 30 December 2025), jointly issued by the China Securities Regulatory Commission (CSRC) and MOF, which introduced a rewards framework for reports of illegal activity in the financial markets.

The trajectory is clear: China is steadily expanding its financial rewards framework on a sector-by-sector basis, with the pharmaceutical and financial services sectors having seen the most significant developments in 2025.

The PIPL Dimension: Data Protection and Whistleblowing

Any organisation running a whistleblowing programme in China must understand the Personal Information Protection Law (PIPL, effective November 2021). The PIPL is China’s primary data protection statute – broadly comparable in intent to the EU’s General Data Protection Regulation (GDPR), though stricter in certain areas – and it has significant practical implications for how whistleblowing reports are collected, handled, and transferred.

A whistleblowing report will almost always contain personal information within the meaning of the PIPL – the name and details of the reporter, the person accused of wrongdoing, or third-party witnesses. In many cases, the content of a report will also include sensitive personal information, such as financial account details or health-related information, which attracts stricter obligations under the law.

The most significant practical challenge for multinationals arises from the PIPL’s cross-border data transfer restrictions. Where a report submitted in China is processed or investigated outside China – for example, by a compliance team or an external reporting service provider based in the UK or Europe – that transfer is subject to the PIPL’s transfer regime. To transfer personal information out of China lawfully, an organisation must use one of three approved mechanisms:

• a CAC Security Assessment, mandatory for transfers of important data or personal information above specified volume thresholds, and which must be renewed every three years
• Standard Contractual Clauses (SCCs) as formulated by the Cyberspace Administration of China (CAC), which must be filed with the relevant local CAC authority and are suited to lower-volume transfers below the Security Assessment thresholds
• Certification under the Measures for Certification of Cross-Border Transfer of Personal Information (effective January 2026), which provides a structured third-party certification route particularly suited to ongoing or complex intra-group transfers in multinational corporations

Overseas entities that process the personal information of individuals in China are also required to appoint a China-based representative or establish a dedicated local entity to handle data protection compliance and liaison duties.

The practical guidance from specialists is clear: minimising cross-border data transfer is the most effective risk mitigation strategy. Where possible, initial screening and anonymisation of whistleblowing reports should be carried out within China before any information is transferred internationally.

Considérations propres à chaque secteur

Beyond the general framework above, certain regulated sectors in China are subject to additional whistleblowing-related requirements. Financial institutions – including banks, securities firms, insurance companies, and fund management companies – are subject to specific guidance from their respective regulators on the establishment and management of internal reporting mechanisms. The pharmaceutical sector has, as noted above, been the subject of specific reward measures since May 2025. Organisations in these sectors should ensure their whistleblowing programmes reflect the relevant sector-specific requirements alongside the general framework.

Conclusion

China’s whistleblowing landscape is evolving quickly. The sector-specific expansion of financial rewards programmes in 2025, the tightening of PIPL enforcement, and the growing expectation from SASAC and other regulators that organisations will maintain effective internal reporting mechanisms all point in the same direction – towards a more structured, more regulated approach to speak-up culture. For multinationals operating in China, and for Chinese enterprises with international operations or ambitions, building a properly structured whistleblowing programme is no longer a reputational nicety. It is an increasingly important component of regulatory compliance.

Our Recommendation

The intersection of whistleblowing obligations and data protection law in China is genuinely complex, and organisations that try to manage it through an informal or ad hoc approach run real risk – both regulatory and reputational. The most robust approach is to work with an external whistleblowing service provider that understands both dimensions: one that can structure a reporting channel in a way that is compliant with the PIPL’s data handling requirements, minimises unnecessary cross-border data transfer, and still provides the independence and confidentiality that employees need in order to speak up. For multinationals, this means ensuring your global whistleblowing programme is configured for China-specific compliance, not simply extended into China as-is. Safecall has experience supporting organisations operating across complex, multi-jurisdictional environments and can help you think through the right approach for your China operations.

Comment Safecall peut vous aider

Safecall provides anonymous reporting channels – including dedicated telephone hotlines and secure online portals – available to employees 24 hours a day, 7 days a week, 365 days a year, across more than 150 countries and in over 175 languages and dialects, including Mandarin and Cantonese. Our call handlers have 25 or more years of interview experience each, and our case management platform provides the auditable record of disclosures and actions that good governance and regulatory compliance requires.

All whistleblower data is held securely in the UK and our systems are fully GDPR compliant. For organisations operating in China, Safecall can work with you and your legal advisers to ensure your reporting channel is configured in a way that reflects the PIPL’s requirements for cross-border data transfer and data minimisation. We support organisations in building not just the infrastructure for reporting, but the speak-up culture that makes it effective.

Références

[1] Basic Rules for Enterprise Internal Control (2008), jointly issued by the Ministry of Finance, China Securities Regulatory Commission, National Audit Office, China Banking Regulatory Commission, and China Insurance Regulatory Commission

[2] Measures for the Compliance Management of Central Enterprises (2022), SASAC

[3] Personal Information Protection Law of the People’s Republic of China (PIPL), effective 1 November 2021

[4] Interim Measures for Reporting and Rewarding Major Violations in the Field of Market Regulation, SAMR and MOF, effective December 2021

[5] Notice on Rewarding Internal Whistleblowers for Reporting on the Quality and Safety Issues of Drugs and Medical Devices, National Medical Products Administration, SAMR, and MOF, effective 29 May 2025

[6] Provisions for Awarding Whistleblowers of Illegal Securities and Futures Activities, CSRC and MOF, effective 30 December 2025

[7] Measures for the Certification of Cross-Border Transfer of Personal Information, CAC and SAMR, effective 1 January 2026

[8] CMS Law, Managing Whistleblower Allegations in China – Need to Know for Foreign Companies Operating in China (March 2026)

[9] Zhong Lun Law Firm, China’s Whistleblowing Advances in Financial and Pharma Sectors (November 2025)

[10] World Law Group, 2024 WLG Whistleblower Guide: China (March 2025)

[11] DLA Piper, China’s Whistleblowing Regulations in the Spotlight (Q1 2022)

[12] Arnold & Porter, China Clarifies Cross-Border Data Transfer Rules (June 2025)

Les résumés fournis sur ce site Web sont uniquement destinés à titre informatif et à titre indicatif. Demandez toujours l'avis d'un spécialiste juridique compétent avant de prendre des décisions fondées sur la législation relative à la dénonciation. Safecall peut vous recommander des spécialistes juridiques compétents si nécessaire. N'hésitez pas à demander plus de détails.