An article analysing the enforcement cases and criminal actions against violations of cybersecurity obligations following the effectiveness of the 2016 Cybersecurity Law and the 2017 Judicial Interpretation on Privacy Criminal Offences. The article also discusses the implications these cases may have on the actions that businesses operating in China should consider taking to mitigate their cybersecurity and data compliance risks.