effectiveVerified 2026-10-09
A clause-linked selection of changes in scope, child protection, data, reminders, assessment and enforcement. Lifecycle governance and user-count assessment triggers were already in the draft. This is original analysis, not a complete redline or official translation.
- The final scope expressly requires sustained emotional interaction and excludes listed task services without that feature.
- Virtual intimate relationships are prohibited for minors; guardian consent cannot override the prohibition.
- Copying is added to data controls; the training-consent clause is narrowed without waiving general privacy duties.
Open comparisoneffectiveVerified 2026-07-22
The 2026 guideline does not repeal or replace the 2021 trial provisions. It operationalizes the national data-export framework for automotive scenarios by setting out route selection, exemptions, important-data identification, filing steps and security controls.
- The 2021 provisions establish baseline automotive-data processing and export duties; the 2026 guideline adds an operational export workflow.
- The 2026 guideline aligns automotive exports with security assessment, standard contract and certification routes.
- The 2026 guideline adds nine stated exemption scenarios and scenario-based important-data identification.
Open comparisonEffectiveVerified 2026-09-11
The amendment adds national-policy and artificial-intelligence provisions, links personal-information handling to the PIPL and Civil Code, restructures liability provisions, increases consequence-based penalties, and broadens the extraterritorial provision.
- New provisions address national cybersecurity policy and artificial-intelligence development and security.
- Personal-information handling is expressly linked to the PIPL, Civil Code, and other laws and administrative regulations.
- Liability provisions are reorganized with higher penalties for serious consequences and new mitigation language.
Open comparisondraftVerified 2026-07-30
A source-controlled comparison of publication status and implementation use. It does not reproduce either standard and does not claim that the consultation draft has replaced GB/T 35273-2020.
- The 2026 document is a consultation draft, not an effective national standard.
- GB/T 35273-2020 remains the published edition until an official successor is recorded.
- Draft-only controls should be separated from current-state implementation requirements.
Open comparisoneffectiveVerified 2026-07-22
The final measures turn the consultation framework into an effective eight-authority instrument, preserve the four-category approach, and add a fixed commencement date and express presentation, recommendation and prominent-placement controls.
- The consultation proposal became a jointly issued eight-authority instrument.
- The final text organizes covered information into four operational categories.
- The final rule took effect on 1 March 2026 and includes express prominent-position and recommendation controls.
Open comparisoneffectiveVerified 2026-09-28
A selected substantive comparison of the draft and controlling final text: report clocks, assessment institutions, information handling, supervision and provisions not carried forward. Retained rules are identified expressly. This is original analysis, not a full redline or an official translation.
- Annual report submission changes from 10 to 20 working days; authority forwarding remains a separate 10-working-day clock.
- The draft report annex is not retained. Competent-authority requirements and relevant standards now guide report preparation.
- Institution rotation is expressly annual; information may be deleted or properly disposed of under contract.
Open comparisoneffectiveVerified 2026-07-19
The 2022 rules established the certification process and certificate lifecycle for personal-information protection, including cross-border processing. The 2025 measures add a dedicated departmental-rule basis for the export-certification route, define route eligibility, regulate overseas recipients and certification institutions, and connect the route to current cross-border data rules.
- The 2025 measures expressly define who may use export certification and exclude important data.
- The newer measures add dedicated obligations for processors, overseas recipients, certification bodies, and oversight authorities.
- The existing three-year certificate term and six-month renewal window remain part of the certification framework rather than being newly created in 2025.
Open comparisonupcomingVerified 2026-07-26
The final provisions preserve the proportionate-compliance model for eligible small processors, confirm the fewer-than-100,000-person threshold, add the Ministry of Public Security as a joint issuer, and establish a fixed commencement date.
- The consultation proposal became a joint CAC and Ministry of Public Security departmental rule.
- The final text confirms that the threshold is fewer than 100,000 persons, not 100,000 or fewer.
- The final provisions establish an effective date of 1 September 2026 and confirm simplified audit, impact-assessment and selected cross-border arrangements.
Open comparison