During the COVID-19 pandemic period, China used a data-based approach to protect public health. Although this approach has supported the containment of the COVID-19 virus, it risks infringing the right to privacy. This paper considers how this data-based approach, including data collection, sharing, storage and disclosure could affect the right to privacy, and shows that the data collection process in China may involve the collection of irrelevant personal data from too many broad categories and sometimes without consent of the data subject. The results show that the main challenges to the right to privacy are (1) a lack of effective information control and storage safeguards, (2) the improper use and disposal of information and (3) the disclosure of non-desensitised information. This article examines PRC’s newly passed legislation, including the Cybersecurity Law, Data Security Law, and the Personal Information Protection Law, which constitute China’s first systematic and comprehensive regulatory framework to protect personal information. This regulatory framework requires that any restrictions on the right to protect personal information and privacy rights must be in the public interest such as public health and security. This article examines whether and to what extent this regulatory framework is capable of addressing challenges of big data applications to individual rights to privacy and proposes some further improvements.