Small personal information processors: simplified measures and surviving duties

Simpler ways to comply, not a general exemption

The CAC and Ministry of Public Security issued Order No. 25 dated 22 July 2026; the CAC announcement was published on 24 July. Article 22 sets commencement at 1 September 2026. This is a final departmental rule, not the April consultation draft. The MOFCOM republication dated 28 July provides the full Chinese provisions; that later website date is not a different effective date.

The useful distinction is between an obligation, a simpler way of performing it, and relief available only when specific conditions hold. A shorter policy can still need meaningful disclosure. A simplified assessment still needs an assessment. Platform coverage cannot be assumed merely because a business has an account on a marketplace.

Apply the person threshold to the right activity

Article 2 applies to small personal information processors within China and defines small as processing personal information of fewer than 100,000 people. Exactly 100,000 is outside that definition. This is not an employee, turnover or company-registration-size test. The provision does not specify that its size test resets on 1 January; do not import the separate annual export counter in Article 10 into Article 2.

As an internal evidence practice, identify the processor, systems and people included in the count, the date measured, duplicates and unresolved records. Explain why the count reflects people rather than logins or orders. The following examples illustrate the strict boundary; they are not an official counting methodology. Recheck the position when datasets, services or group responsibilities change.

Choose a disclosure route that matches the business

Article 4 still requires the processor's identity, a contact for individual rights, purposes, methods, data categories and retention information. Information about children under 14 needs special processing rules. Article 6's disclosure-only route has cumulative conditions: necessary non-sensitive information and no provision to other processors or public disclosure. Its policy must be prominent, accessible and saveable; a buried website link is not the proposed model.

Article 7 addresses informed, voluntary and active provision of information necessary to obtain a service after disclosure. Do not turn that into blanket permission for unrelated marketing or sensitive-data collection. Its sensitive-information provision retains notice of necessity and effects on rights and separate consent, subject to other applicable rules.

Article 8 is a coverage test. The activity must remain within the platform, without provision to outside processors; the platform must publish rules for the activity and agree respective responsibilities; the small processor must follow those rules and stay within their purposes, methods and categories. Audit or assessment work avoids duplication only where the platform has actually completed it and it covers that activity.

Keep the audit clock separate from the assessment trigger

The rule reduces the formality of certain records, not the need to identify risk. Article 13 permits a simplified audit self-check at least once every five years and retention of that self-check for at least five years. Special audit requirements for minors in laws or administrative regulations still govern. Article 14 allows a simplified impact-assessment form retained for at least three years; it does not replace the PIPL's prior-assessment triggers with a five-year timetable.

Do not confuse small size with unrestricted exports

Article 10 lists six routes for relief from the security-assessment, standard-contract and certification mechanisms: necessary performance of an individual's contract; qualifying cross-border HR administration; emergencies protecting life, health or property; necessary statutory duties or obligations; the specified non-CII annual transfer of fewer than 100,000 people's non-sensitive information; or other legally specified conditions. Read the conditions of the route actually used, not just its short label.

Important data is excluded from that relief. The non-CII volume route excludes sensitive personal information and counts from 1 January of the current year. Disclosure, separate consent and other applicable duties remain relevant under the law. Neither 50,000 customer records nor a supplier's promise that it is secure proves a mechanism exemption. Record the data, recipient, necessity, selected legal route and remaining safeguards separately.

Where a small processor must apply for a security assessment, Article 10 also permits a provincial CAC recommendation submitted for national approval. That is an administrative arrangement, not self-approval by the exporter. Use the current filing instructions and authority channels for an actual application.

Build a compact but operational evidence file

The following is an original working checklist, not a reproduction of the official annex forms. Give each item an owner and evidence location rather than treating the checklist itself as proof of compliance. Article 21 retains supervision and cooperation duties. Articles 18–19 concern specified penalty treatment; they do not authorize processing first and checking legality only after a complaint.

Example: a platform shop adds an outside CRM

Assume a domestic merchant processes information about 40,000 people, uses only one platform and has evidence that the platform's rules and completed assessments cover order fulfilment. It now proposes sending buyer contacts to an outside processor for promotional campaigns. The business may remain below the size threshold, but the proposed activity conflicts with the platform-only coverage conditions and may exceed the recorded purpose.

Pause that new use while identifying the parties' roles, a lawful processing basis, disclosure, any required consent and prior impact assessment. Update the evidence file and review overseas access if the new provider is abroad. The useful answer is not 'small businesses cannot use a CRM' or '40,000 means exempt'; it is that size and activity-specific conditions must be tested separately.

Apply the final rule without overstating the version comparison

For a current workflow, use the final Order No. 25 and its two official annex forms. The earlier consultation explains the drafting history, not today's operative text. This page explains the final provisions; it does not claim a line-by-line comparison of every draft or annex field. Access the official forms through the linked full-text republication rather than substituting this site's working tables.

Start with a scope note, select only the simplified measures whose conditions you can evidence, assign the remaining duties, then establish review points for growth, sensitive information, minors, outside-platform processing and cross-border transfers. This order makes the reduced paperwork a controlled decision rather than an assumption.

Official sources & revisions

• CAC and Ministry of Public Security: announcement of 24 July 2026
• Order No. 25, Articles 1–8: scope, notices and platform coverage (official MOFCOM republication)
• Order No. 25, Articles 9–17 and 21–22: transfers, records, safeguards and commencement
• PIPL Articles 13, 28–31 and 55–56: legal bases, sensitive information and prior assessments

2026-09-11: Expanded the existing regulation record into a bilingual final-rule analysis with eligibility, platform, audit and assessment matrices, surviving-duty checks and a clearly hypothetical workflow. Cross-checked the CAC announcement and official full-text republication; no claim of a complete annex redline.

Examples and working tables are original research aids, not official forms or legal advice.

Continue researching

• PIPIA: triggers, evidence and decisions
• Compliance audit: scope, cycles and remediation
• July transfer Q&A and extension examples