Swingeing fines and the revocation of business permits are the order of the day for China’s new data protection law, which stipulates that firms that are guilty of serious offences can pay fines of up to 50m renminbi (US$7.74m), or 5 percent of their annual turnover.