中文研究版
小型个人信息处理者简化措施征求意见稿与正式规定比较
Simplified Measures for Small Personal Information Processors: Draft vs. Final Provisions
比较适用门槛、机关、法律状态、合规审计、影响评估和数据出境安排从草案到正式规定的变化。
版本变化
重要变化概览
CAC consultation draft of 3 April 2026 and final joint provisions published 24 July 2026
The final provisions preserve the proportionate-compliance model for eligible small processors, confirm the fewer-than-100,000-person threshold, add the Ministry of Public Security as a joint issuer, and establish a fixed commencement date.
- The consultation proposal became a joint CAC and Ministry of Public Security departmental rule.
- The final text confirms that the threshold is fewer than 100,000 persons, not 100,000 or fewer.
- The final provisions establish an effective date of 1 September 2026 and confirm simplified audit, impact-assessment and selected cross-border arrangements.
来源核验：
Legal status and issuing authorities
- 此前规则摘要
- The April text was a CAC consultation proposal without binding effect.
- 对照规则摘要
- The final provisions are jointly issued by the CAC and Ministry of Public Security and take effect on 1 September 2026.
实际影响：Organizations should implement the final text and retain the draft only for version history.
Official publication announcement and final provisions.
Eligibility threshold
- 此前规则摘要
- The proposal targeted qualifying small personal information processors.
- 对照规则摘要
- The final rule applies the stated small-processor framework to processors handling personal information of fewer than 100,000 persons, subject to the rule's exclusions and counting method.
实际影响：The threshold excludes a processor at exactly 100,000 persons; current natural persons are counted and deleted personal information is excluded as explained in the official Q&A.
Read the final text together with the CAC Q&A issued on 24 July 2026.
Compliance audit
- 此前规则摘要
- The draft proposed a proportionate audit arrangement.
- 对照规则摘要
- The final framework confirms a simplified audit cycle, with the official Q&A explaining an interval of at least once every five years and a certification-related exemption during validity.
实际影响：Eligible processors should document both threshold eligibility and the basis for using the simplified audit schedule.
Official explanatory Q&A; the underlying conditions must be checked before reliance.
Impact assessment and cross-border arrangements
- 此前规则摘要
- The draft proposed simplification of selected assessment and data-export compliance steps.
- 对照规则摘要
- The final provisions retain proportionate treatment for specified personal information protection impact assessments and selected cross-border data transfer arrangements.
实际影响：Simplification is conditional and does not eliminate the need to check the PIPL, network-data rules, sensitive-personal-information conditions or national data-export mechanisms.
Use the official final text and annex self-check materials; do not generalize the simplifications beyond their stated scope.