What the document does, and does not do
The notice says the proposal integrates the earlier drafts on large-platform personal information protection and supervisory committees. Its consultation deadline was 7 September 2026. The deadline closes a feedback window; it is not an enactment date. This research concerns that proposal, not a confirmed final instrument.
Screen the processing activity, not just the brand
Draft Article 2 combines a processing scale of at least 10 million individuals with important online services or multiple lines of business involving personal information, and significant wider effects. Article 3 proposes an application through the provincial CAC for processors meeting the scale test and self-assessing that the other two conditions apply. National designation and publication of the list follow; ten million accounts alone is not equivalent to designation.
For preparation, separate the legal entity, the service and the dataset. A group's marketing dashboard may count accounts rather than people and may combine entities that make different processing decisions. Record those distinctions before using the figures in a designation analysis. Do not label a business formally designated merely because an internal screening suggests potential coverage.
Proposed controls and the evidence they would need
The matrix below selects operationally significant clauses, not every draft duty. It is a preparation tool, not an instruction to implement a proposal as current law. Keep draft-dependent expenditure separate from controls already required under the PIPL.
| Draft location | Proposed requirement | Preparation evidence |
|---|---|---|
| Articles 13–16 | Domestic storage and data-centre eligibility; written outsourcing terms. | Storage locations, operator ownership and a contract gap register. Do not infer an absolute export ban; Article 20 preserves the national transfer framework. |
| Article 19 | Qualifying portability requests: 30 working days after identity and request verification; a justified further 30 working days. | Separate verification, fulfilment and extension timestamps; document eligibility and explanations. |
| Articles 25, 30 | Management-level privacy lead; previous-year social responsibility report published in the first half of the year. | Decision authority, reporting lines and a report evidence owner for each subject. |
| Articles 31–33 | Covered high-impact launches: prior PIPIA, with filing within 15 working days after completion. At least biennial compliance audits and annual risk assessments; minors' audits remain annual. | Keep launch approval, PIPIA completion, filing and audit schedules separate; one assessment does not substitute for all four. |
| Articles 36–37 | After designation: specified information within 30 working days; supervisory committee within six months, with an odd membership of at least seven and at least two-thirds external members. | Use the formal designation date, not draft publication, as the proposed starting point. Retain independence checks. |
| Article 43 | Committee activity reporting in the first quarter; audit reporting at least every two years. | Distinguish public disclosure, internal approval and regulator submission. |
A practical version-control matrix
Treat the consolidation as a mapping task. Preserve the earlier draft location, the corresponding August location and the reason an internal control would change. A missing paragraph may have moved or been combined; absence from one heading is not sufficient evidence of deletion.
| Research question | Evidence to retain | Do not infer |
|---|---|---|
| Has the covered entity changed? | Both definitions and designation provisions | All large companies are covered |
| Has an obligation moved? | Old and new clause references | A moved clause was abolished |
| Must action be taken now? | Current law versus proposed wording | Consultation creates an immediate duty |
Illustrative scenario: a multi-service group
A group operates a shopping service and a health application. The research owner should not simply add the two account totals and assign every duty to the holding company. First identify who determines each processing purpose, which datasets overlap, and which services create distinct risks. Retain unresolved questions for qualified advice rather than disguising them as a final designation decision.
Useful preparatory outputs are a responsibility map, a dataset inventory and a traceable change register. These can improve readiness without claiming that the draft requires immediate restructuring. This is an illustrative research workflow, not a client case or legal opinion.
What to monitor next
Monitor the official final text, designation process and any expressly stated transition. Reopen the mapping when those sources appear. Maintain existing PIPL duties independently; a possible future simplified or specialised framework is not a reason to stop current controls.
Official sources & revisions
: Expanded the designation test and added clause-located proposed controls, deadlines and preparation evidence after rereading the official draft on 10 September.
Examples and working tables are original research aids, not official forms or legal advice.
Suggest a correction