中文研究版
Simplified personal information protection measures for small processors published
比较适用门槛、机关、法律状态、合规审计、影响评估和数据出境安排从草案到正式规定的变化。
What changed
比较适用门槛、机关、法律状态、合规审计、影响评估和数据出境安排从草案到正式规定的变化。
The April text was a CAC consultation proposal without binding effect.
The final provisions are jointly issued by the CAC and Ministry of Public Security and take effect on 1 September 2026.
实际影响：Organizations should implement the final text and retain the draft only for version history.
Official publication announcement and final provisions.
The proposal targeted qualifying small personal information processors.
The final rule applies the stated small-processor framework to processors handling personal information of fewer than 100,000 persons, subject to the rule's exclusions and counting method.
实际影响：The threshold excludes a processor at exactly 100,000 persons; current natural persons are counted and deleted personal information is excluded as explained in the official Q&A.
Read the final text together with the CAC Q&A issued on 24 July 2026.
The draft proposed a proportionate audit arrangement.
The final framework confirms a simplified audit cycle, with the official Q&A explaining an interval of at least once every five years and a certification-related exemption during validity.
实际影响：Eligible processors should document both threshold eligibility and the basis for using the simplified audit schedule.
Official explanatory Q&A; the underlying conditions must be checked before reliance.
The draft proposed simplification of selected assessment and data-export compliance steps.
The final provisions retain proportionate treatment for specified personal information protection impact assessments and selected cross-border data transfer arrangements.
实际影响：Simplification is conditional and does not eliminate the need to check the PIPL, network-data rules, sensitive-personal-information conditions or national data-export mechanisms.
Use the official final text and annex self-check materials; do not generalize the simplifications beyond their stated scope.