While mobile payments bring great benefits like convenience, flexibility and efficiency, they are not without risks. Among them, the data privacy risk is probably one of the most serious, which is largely caused and exacerbated by the involvement of multiple players and the extensive collection of personal information. China has been trying to consolidate and modernize its regulatory regime for data privacy to suit the needs of the new digital era. China has made great efforts to enact new laws and regulations to delineate the scope of personal information, introduce the obligations for data controllers and processors and incorporate the principles of the Fair Information Practices. However, there are some remaining concerns; the ineffective requirements of consent and disclosure, the ambiguous principle of purpose limitation and the limited applicability of the principle of data minimization. There is a need for China to enact a specific law for data protection, establish a unified law enforcement agency and enhance private and public enforcement. The issue of data privacy is not unique or limited to mobile payment and can apply to other sectors of Fintech and even beyond.