The legal protection of biometric data is becoming an increasingly important issue in the information society. China attaches importance to the legal protection of biometric data. Over the past decades, the rapid development of digital technology has profoundly influenced Chinese information society. However, digital technology may also trigger substantial risks. In this article, we provide an in-depth examination of existing Chinese laws protecting biometric data. We explore general laws and facial recognition laws, administrative regulations, sector-based rules, judicial interpretations, regulatory documents, policy documents, and (draft) national standards. We find gaps in laws in China. Building on this analysis, we elaborate on five principles for the legal protection of biometric data: (1) legality, propriety, and necessity; (2) integrity; (3) purpose; (4) minimization; and (5) controllability. We provide three policy recommendations for the legal protection of biometric data: (1) sufficiently considering the purpose of the collection of biometric data, (2) creating controllable mechanisms, and (3) implementing regulatory compliance programs.