October 2026
Practical Interpretation of the New Compliance Rules for Small-Scale Personal Information Processors (Mainland China)
On July 22, 2026, the Cyberspace Administration of China and the Ministry of Public Security jointly issued the Provisions on Simplified Measures for Personal Information Protection by Small-Scale Personal Information Processors (hereinafter referred to as the Provisions). The Provisions officially took effect on September 1, 2026. Authorized under Article 62 of the Personal Information Protection Law, it is China’s first dedicated supporting rule on personal information protection for small and micro entities. From a practical perspective, the Provisions abandon the “one-size-fits-all” regulatory model and establish a refined governance system featuring reduced procedural burdens, unchanged bottom-line requirements and tiered regulatory leniency. It alleviates the practical problem of excessive compliance costs faced by micro, small and medium-sized enterprises and individual industrial and commercial households, while strictly guarding the red line for the protection of personal information rights and interests, and providing clear guidance for market entities to operate in compliance with laws.
I. Subject Identification: Defined Standards and Clear Constituent Elements
Article 2 of the Provisions specifies the core criteria for identifying small-scale personal information processors: processors that handle personal information of fewer than 100,000 natural persons. The statistical standard is based on the current actual number of natural persons whose personal information is processed; deleted personal information is not included in the statistics. An enterprise’s registered capital, number of employees and operating revenue do not affect the determination of subject qualification. Where the stock number of users remains below 100,000, the simplified compliance regime applies. Meanwhile, the Provisions contain an exception clause: entities processing personal information of minors under the age of 14 may not apply all simplified measures. They must strictly implement special personal information protection rules and fulfill the special protection obligations for minors’ personal information.
Legislatively, the adoption of a classification model purely based on data volume avoids ambiguous regulatory discretion arising from judging subject qualification by enterprise scale. In practice, enterprises can quickly determine whether the Provisions apply to them by sorting user ledgers and counting the stock number of natural persons, rendering the compliance boundary highly operable.
II. Notification and Consent: Simplified Form with Substantive Obligations Preserved
The obligation of notification and consent constitutes the core link of personal information protection. For non-sensitive personal information, the Provisions design three differentiated simplified paths, substantially cutting the manpower costs incurred by small and micro entities in document preparation and individual notification.
A. Public notice in lieu of individual notification:
Where necessary non-sensitive personal information is processed for service provision, without transfer to third parties or public disclosure, the notification obligation may be fulfilled by posting information processing rules in a prominent position.
B. Conduct deemed consent:
Where a natural person voluntarily submits necessary information to obtain services with full knowledge of relevant facts, such submission may be presumed as consent, and separate checkbox authorization is not required.
C. Unified compliance via platforms:
Merchants settled on online platforms who conduct business relying on processing rules publicly disclosed by the platform and do not externally transmit personal information may be exempted from formulating independent privacy policies and repeating notification procedures.
At the same time, the Provisions require publicly posted content to be presented in prominent ways such as bolding, font enlargement or color marking. Hidden clauses in fine print are prohibited to safeguard users’ right to know.
III. Sensitive Personal Information: Simplified Procedures with Clear Boundaries
Regarding the processing of sensitive personal information, Article 7 of the Provisions restricts the scope of simplification and clarifies that sensitive personal information is not eligible for the above simplified approaches. When processing facial recognition, biometric, financial, health and other types of sensitive personal information, processors may only notify individuals of the necessity of processing and impacts on their rights and interests in privacy rules. Separate explicit consent must be obtained. Voluntary submission of sensitive personal information by a natural person cannot replace the statutory obligation to obtain separate consent. This provision maintains the high protection standard set forth in the Personal Information Protection Law. It prevents small and micro entities from neglecting the protection of high-risk information due to procedural simplification, and mitigates risks of information leakage and abuse at the source.
IV. Impact Assessment and Audit: Simplified Procedures with Obligations Retained
Personal information protection impact assessments and regular compliance audits have long been high-cost compliance items for micro, small and medium-sized enterprises. The Provisions clarify that the impact assessment obligation stipulated in Article 55 of the Personal Information Protection Law remains mandatory. Nevertheless, the Cyberspace Administration of China has released supporting simplified assessment templates. Enterprises may directly adopt standardized forms to complete assessments, with assessment records retained for no less than three years. Reassessment shall be conducted where the purpose or method of processing undergoes material changes. The compliance audit cycle is extended from annual audits applicable to ordinary entities to at least once every five years, accompanied by supporting simplified self-inspection forms. Enterprises holding personal information protection compliance certifications are exempted from audits during the validity period of the certifications, further reducing long-term compliance costs.
In practice, many small and micro entities lack professional legal teams. The Provisions attach standard forms as annexes, substantially lowering the professional threshold for assessments and audits. In addition, merchants operating through platforms do not need to repeat assessments and audits if the platform has completed such work at the platform level, achieving coordinated compliance between platforms and settled merchants.
V. Cross-Border Data Transfer: Exemption from Conventional Approval for Five Scenarios
To address compliance pain points of small and micro enterprises engaged in cross-border operations, the Provisions set up facilitative rules for cross-border data transfer. Small-scale processors handling fewer than 100,000 natural persons’ data and transferring non-sensitive personal information may be exempted from the three conventional outbound approval procedures, i.e., security assessment, standard contract filing and outbound certification in the following five scenarios, and only need to retain transfer ledgers for inspection: Performance of cross-border contracts; Cross-border human resources management; Emergency risk avoidance; Performance of statutory obligations; Processors other than critical information infrastructure operators whose annual cross-border transfer involves fewer than 100,000 natural persons.
In practice, it should be noted that cross-border exemptions apply only to purely non-sensitive information. If the transmitted content includes sensitive personal information such as biometric data or financial records, regardless of the volume, the full outbound compliance process must be followed.
VI. Regulatory Leniency: Differentiated Penalty Mechanism
The Provisions establish an inclusive and prudent administrative penalty system, implementing the law enforcement principle of leniency for initial minor violations. Where an illegal act is minor, promptly rectified and causes no harmful consequences, or where the enterprise can prove absence of subjective fault, no administrative penalty shall be imposed. For initial violations with minor harmful consequences and timely rectification, regulators may exercise discretion not to impose administrative penalties and use interviews or warning letters instead. This rule accommodates the reality that small and micro entities have limited compliance capacity, and avoids harsh penalties that would dampen market vitality.
In summary, the implementation of the Provisions does not mean relaxing data management for enterprises, but rather requires small and micro entities to establish a lightweight, scale-appropriate compliance system. Enterprises should first accurately determine their qualifications by conducting user count statistics; second, clarify information processing scenarios, distinguish between sensitive and non-sensitive information, and separately improve the consent retention process for sensitive data; third, utilize official simplified templates effectively, standardize assessment and auditing processes, and enhance data security emergency plans; finally, maintain a full-process compliance ledger to enjoy policy benefits while safeguarding the statutory baseline of personal information protection.
I. Subject Identification: Defined Standards and Clear Constituent Elements
Article 2 of the Provisions specifies the core criteria for identifying small-scale personal information processors: processors that handle personal information of fewer than 100,000 natural persons. The statistical standard is based on the current actual number of natural persons whose personal information is processed; deleted personal information is not included in the statistics. An enterprise’s registered capital, number of employees and operating revenue do not affect the determination of subject qualification. Where the stock number of users remains below 100,000, the simplified compliance regime applies. Meanwhile, the Provisions contain an exception clause: entities processing personal information of minors under the age of 14 may not apply all simplified measures. They must strictly implement special personal information protection rules and fulfill the special protection obligations for minors’ personal information.
Legislatively, the adoption of a classification model purely based on data volume avoids ambiguous regulatory discretion arising from judging subject qualification by enterprise scale. In practice, enterprises can quickly determine whether the Provisions apply to them by sorting user ledgers and counting the stock number of natural persons, rendering the compliance boundary highly operable.
II. Notification and Consent: Simplified Form with Substantive Obligations Preserved
The obligation of notification and consent constitutes the core link of personal information protection. For non-sensitive personal information, the Provisions design three differentiated simplified paths, substantially cutting the manpower costs incurred by small and micro entities in document preparation and individual notification.
A. Public notice in lieu of individual notification:
Where necessary non-sensitive personal information is processed for service provision, without transfer to third parties or public disclosure, the notification obligation may be fulfilled by posting information processing rules in a prominent position.
B. Conduct deemed consent:
Where a natural person voluntarily submits necessary information to obtain services with full knowledge of relevant facts, such submission may be presumed as consent, and separate checkbox authorization is not required.
C. Unified compliance via platforms:
Merchants settled on online platforms who conduct business relying on processing rules publicly disclosed by the platform and do not externally transmit personal information may be exempted from formulating independent privacy policies and repeating notification procedures.
At the same time, the Provisions require publicly posted content to be presented in prominent ways such as bolding, font enlargement or color marking. Hidden clauses in fine print are prohibited to safeguard users’ right to know.
III. Sensitive Personal Information: Simplified Procedures with Clear Boundaries
Regarding the processing of sensitive personal information, Article 7 of the Provisions restricts the scope of simplification and clarifies that sensitive personal information is not eligible for the above simplified approaches. When processing facial recognition, biometric, financial, health and other types of sensitive personal information, processors may only notify individuals of the necessity of processing and impacts on their rights and interests in privacy rules. Separate explicit consent must be obtained. Voluntary submission of sensitive personal information by a natural person cannot replace the statutory obligation to obtain separate consent. This provision maintains the high protection standard set forth in the Personal Information Protection Law. It prevents small and micro entities from neglecting the protection of high-risk information due to procedural simplification, and mitigates risks of information leakage and abuse at the source.
IV. Impact Assessment and Audit: Simplified Procedures with Obligations Retained
Personal information protection impact assessments and regular compliance audits have long been high-cost compliance items for micro, small and medium-sized enterprises. The Provisions clarify that the impact assessment obligation stipulated in Article 55 of the Personal Information Protection Law remains mandatory. Nevertheless, the Cyberspace Administration of China has released supporting simplified assessment templates. Enterprises may directly adopt standardized forms to complete assessments, with assessment records retained for no less than three years. Reassessment shall be conducted where the purpose or method of processing undergoes material changes. The compliance audit cycle is extended from annual audits applicable to ordinary entities to at least once every five years, accompanied by supporting simplified self-inspection forms. Enterprises holding personal information protection compliance certifications are exempted from audits during the validity period of the certifications, further reducing long-term compliance costs.
In practice, many small and micro entities lack professional legal teams. The Provisions attach standard forms as annexes, substantially lowering the professional threshold for assessments and audits. In addition, merchants operating through platforms do not need to repeat assessments and audits if the platform has completed such work at the platform level, achieving coordinated compliance between platforms and settled merchants.
V. Cross-Border Data Transfer: Exemption from Conventional Approval for Five Scenarios
To address compliance pain points of small and micro enterprises engaged in cross-border operations, the Provisions set up facilitative rules for cross-border data transfer. Small-scale processors handling fewer than 100,000 natural persons’ data and transferring non-sensitive personal information may be exempted from the three conventional outbound approval procedures, i.e., security assessment, standard contract filing and outbound certification in the following five scenarios, and only need to retain transfer ledgers for inspection: Performance of cross-border contracts; Cross-border human resources management; Emergency risk avoidance; Performance of statutory obligations; Processors other than critical information infrastructure operators whose annual cross-border transfer involves fewer than 100,000 natural persons.
In practice, it should be noted that cross-border exemptions apply only to purely non-sensitive information. If the transmitted content includes sensitive personal information such as biometric data or financial records, regardless of the volume, the full outbound compliance process must be followed.
VI. Regulatory Leniency: Differentiated Penalty Mechanism
The Provisions establish an inclusive and prudent administrative penalty system, implementing the law enforcement principle of leniency for initial minor violations. Where an illegal act is minor, promptly rectified and causes no harmful consequences, or where the enterprise can prove absence of subjective fault, no administrative penalty shall be imposed. For initial violations with minor harmful consequences and timely rectification, regulators may exercise discretion not to impose administrative penalties and use interviews or warning letters instead. This rule accommodates the reality that small and micro entities have limited compliance capacity, and avoids harsh penalties that would dampen market vitality.
In summary, the implementation of the Provisions does not mean relaxing data management for enterprises, but rather requires small and micro entities to establish a lightweight, scale-appropriate compliance system. Enterprises should first accurately determine their qualifications by conducting user count statistics; second, clarify information processing scenarios, distinguish between sensitive and non-sensitive information, and separately improve the consent retention process for sensitive data; third, utilize official simplified templates effectively, standardize assessment and auditing processes, and enhance data security emergency plans; finally, maintain a full-process compliance ledger to enjoy policy benefits while safeguarding the statutory baseline of personal information protection.
The contents of all newsletters of Shanghai Lee, Tsai & Partners (Content) available on the webpage belong to and remain with Shanghai Lee, Tsai & Partners. All rights are reserved by Shanghai Lee, Tsai & Partners, and the Content may not be reproduced, downloaded, disseminated, published, or transferred in any form or by any means, except with the prior permission of Shanghai Lee, Tsai & Partners.
The Content is for informational purposes only and is not offered as legal or professional advice on any particular issue or case. The Content may not reflect the most current legal and regulatory developments. Shanghai Lee, Tsai & Partners and the editors do not guarantee the accuracy of the Content and expressly disclaim any and all liability to any person in respect of the consequences of anything done or permitted to be done or omitted to be done wholly or partly in reliance upon the whole or any part of the Content. The contributing authors' opinions do not represent the position of Shanghai Lee, Tsai & Partners. If the reader has any suggestions or questions, please do not hesitate to contact Shanghai Lee, Tsai & Partners.
