Public source reference library for China data regulation
AlertsSource policyMy Library中文
China Data RegulationIndependent regulatory research

Research across the library

Search laws, regulations, standards and guides

Suggested searches

Current priorities

2026-07-03Revised Internet Information Service Measures draft2026-06-18Network data risk assessment: draft versus final

Source-verified comparison

Simplified Measures for Small Personal Information Processors: Draft vs. Final Provisions

CAC consultation draft of 3 April 2026 and final joint provisions published 24 July 2026

Previous version2026-04-03
Current version2026-07-24
Legal statusupcoming
Effective date2026-09-01

What changed

Material differences at a glance

The final provisions preserve the proportionate-compliance model for eligible small processors, confirm the fewer-than-100,000-person threshold, add the Ministry of Public Security as a joint issuer, and establish a fixed commencement date.

  • The consultation proposal became a joint CAC and Ministry of Public Security departmental rule.
  • The final text confirms that the threshold is fewer than 100,000 persons, not 100,000 or fewer.
  • The final provisions establish an effective date of 1 September 2026 and confirm simplified audit, impact-assessment and selected cross-border arrangements.

Source comparison

4 reviewed change records
modified

Legal status and issuing authorities

Previous rule summary
The April text was a CAC consultation proposal without binding effect.
Compared rule summary
The final provisions are jointly issued by the CAC and Ministry of Public Security and take effect on 1 September 2026.

Practical impact: Organizations should implement the final text and retain the draft only for version history.

Official publication announcement and final provisions.

clarified

Eligibility threshold

Previous rule summary
The proposal targeted qualifying small personal information processors.
Compared rule summary
The final rule applies the stated small-processor framework to processors handling personal information of fewer than 100,000 persons, subject to the rule's exclusions and counting method.

Practical impact: The threshold excludes a processor at exactly 100,000 persons; current natural persons are counted and deleted personal information is excluded as explained in the official Q&A.

Read the final text together with the CAC Q&A issued on 24 July 2026.

clarified

Compliance audit

Previous rule summary
The draft proposed a proportionate audit arrangement.
Compared rule summary
The final framework confirms a simplified audit cycle, with the official Q&A explaining an interval of at least once every five years and a certification-related exemption during validity.

Practical impact: Eligible processors should document both threshold eligibility and the basis for using the simplified audit schedule.

Official explanatory Q&A; the underlying conditions must be checked before reliance.

modified

Impact assessment and cross-border arrangements

Previous rule summary
The draft proposed simplification of selected assessment and data-export compliance steps.
Compared rule summary
The final provisions retain proportionate treatment for specified personal information protection impact assessments and selected cross-border data transfer arrangements.

Practical impact: Simplification is conditional and does not eliminate the need to check the PIPL, network-data rules, sensitive-personal-information conditions or national data-export mechanisms.

Use the official final text and annex self-check materials; do not generalize the simplifications beyond their stated scope.

Official sources

Previous sourceCurrent source

Sources checked:

This website is for informational and educational purposes only. It does not constitute legal advice. The Chinese text shall prevail. Users should consult qualified legal counsel for specific matters.