China Data Regulation Briefing — 20 August 2026

What changes on 20 August

The final Network Data Security Risk Assessment Measures were published on 18 June and expressly take effect on 20 August 2026. The status change matters: the final text is now the controlling measure, while the 2025 consultation proposal remains useful only for version comparison and legislative history.

The measures concern network data security risk assessment rather than every ordinary privacy review. Organizations should first identify whether the stated assessment circumstances apply, then distinguish a regulator-organized assessment from an assessment commissioned by the data processor. Reports, signatures, remediation and retention duties should be mapped to the exact route being used.

• Replace internal 'upcoming' labels with 'effective' and retain the official publication date separately.
• Use the final annex and reporting period, not the consultation draft's earlier structure.
• Record which assessment trigger, authority and reporting route supports each internal conclusion.

How to read the cybersecurity review announcement

On 6 August, the Cybersecurity Review Office announced a review of products sold in China by Palo Alto Networks. The notice cites the National Security Law, the Cybersecurity Law and the Cybersecurity Review Measures and states that the purpose is to protect the stable operation of critical information infrastructure and guard against cybersecurity risks.

The source is deliberately narrow. It confirms that a review has started, but it does not identify a final result, an affected product list, a completion date or a generally applicable suspension. Procurement and risk teams should therefore track the official proceeding without converting the notice into an unsupported conclusion.

What to prepare before 1 September

Two separate instruments take effect on 1 September. The small-processor provisions create proportionate arrangements for eligible processors but require threshold and exclusion checks. The multi-channel distribution provisions address responsibilities across internet information distribution channels. They should not be combined into one compliance project merely because they share an effective date.

For each instrument, owners should identify the affected service or processing activity, the evidence needed to support scope decisions, and the control changes that must be complete by the effective date. Drafts and policy explanations can support research, but final obligations must be traced to the published instrument.