Continuing regulatory intelligence
A source-verified briefing on the small-processor measures, July cross-border guidance, AI filing activity and upcoming effective dates.
The joint CAC and Ministry of Public Security provisions define eligible small processors by a fewer-than-100,000-person threshold and establish proportionate compliance measures, including simplified audit, impact-assessment and selected cross-border data transfer arrangements. They take effect on 1 September 2026.
Official sourceWhat changedThe official Q&A addresses notification and separate-consent duties, extension conditions for security assessments for cross-border data transfers, and necessity questions for recruitment-related transfers. It is implementation guidance rather than a new binding rule.
Official sourceJuly filing publications report service and algorithm filing activity. They are grouped as operational updates and do not create a new generally binding rule.
Official sourceThe final measures replace the 2025 consultation proposal and introduce a 20-working-day reporting period for specified assessments. They take effect on 20 August 2026.
Official sourceWhat changedThe joint CAC and Ministry of Public Security provisions define eligible small processors by a fewer-than-100,000-person threshold and establish proportionate compliance measures, including simplified audit, impact-assessment and selected cross-border data transfer arrangements. They take effect on 1 September 2026.
Official sourceWhat changedA revised draft was released for public comment. It remains a consultation document and is not presented as current law.
Official sourceThe CAC released a consultation draft for distributed digital identity services. It is tracked as a draft and does not yet impose effective obligations.
Official sourceTC260 opened a draft revision related to GB/T 35273-2020 for public comment. The draft is not an effective national standard and should be monitored as a possible successor framework.
Official sourceWhat changedTC260 opened a draft revision related to GB/T 35273-2020 for public comment. The draft is not an effective national standard and should be monitored as a possible successor framework.
Official sourceWhat changedThe industry guideline explains security practices for automotive cross-border data transfers. It complements rather than replaces the 2021 automotive-data provisions.
Official sourceWhat changed