On July 22, 2026, the Cyberspace Administration of China (CAC) and the Ministry of Public Security jointly issued the Provisions on Simplified Measures for Personal Information Protection by Small-Scale Personal Information Handlers (the “Provisions”), which will take effect on September 1, 2026.
The Provisions are designed to reduce compliance burdens for smaller businesses, while maintaining baseline personal information protection requirements. They introduce a series of streamlined compliance measures for qualifying entities in China.
1. Who qualifies as a “small-scale personal information handler”?
Under the Provisions, a “small-scale personal information handler” refers to a handler, broadly analogous to a data controller under the EU and UK’s data protection regime, that processes personal information of fewer than 100,000 individuals. The threshold is calculated based on the cumulative number of individuals whose personal information is currently processed, excluding personal information that has already been deleted. Currently, the Provisions are not clear exactly how this number is calculated.
In practice, many small and medium-sized enterprises, including business-to-business (B2B) companies, brick-and-mortar retailers and online stores, are likely to fall within this category.
2. Key simplification measures
(1) Streamlined privacy rules
Small-scale personal information handlers are only required to include three core items in their personal information processing notices:
The name of the handler
Department or personnel responsible for handling data subjects’ rights requests and their contact details
The purposes and methods of processing, the categories of personal information processed and the applicable retention periods
Importantly, businesses that process personal information of minors under the age of 14 must still adopt a dedicated and age-compliant personal information processing policy for such processing.
(2) Alternative notice mechanism through public disclosure
The Provisions allow eligible small-scale personal information handlers to satisfy notification obligations by publicly disclosing their personal information processing rules, rather than providing notice to each individual separately.
This simplified approach is available where:
No sensitive personal information is processed
The personal information processed is necessary for the provision of products or services
Personal information is neither disclosed to any other personal information handler (i.e. controller) nor made publicly available, and this is expressly stated in the personal information processing rules
The processing rules must be presented in a prominent and easily accessible manner.
For offline businesses, the processing rules may be disclosed through simple means such as notices prominently displayed at the business premises. For online businesses, disclosure may be made through websites, service agreements or pop-up notices within mobile applications.
(3) Simplified consent mechanism
According to the Provisions, where a small-scale personal information handler has properly disclosed its processing rules and fulfilled its notification obligations, and an individual voluntarily provides or voluntarily cooperates in providing, personal information necessary for obtaining a product or service, such affirmative conduct may serve as a valid expression of consent.
This reflects a more practical approach to consent, reducing reliance on formal consent mechanisms such as separate forms or click-through acknowledgements.
However, the simplification does not apply to sensitive personal information. Where sensitive personal information is processed, small-scale personal information handlers must continue to provide specific disclosures regarding necessity and potential impact on individuals’ rights and obtain separate consent as required under the Personal Information Protection Law (PIPL).
(4) Reliance on platforms
Small-scale handlers operating exclusively through an online platform (such as Douyin, Tmall or JD.com), and not providing personal information to other personal information handlers outside the platform may rely on the platform’s personal information processing rules, provided that:
The platform has established compliant processing rules
The respective rights and obligations of the platform, as well as the small-scale handler are clearly allocated
The small-scale handler undertakes to comply with such rules, and its processing of personal information is necessary for the provision of products or services
Similarly, industrial parks, commercial complexes and other business management entities may formulate unified processing rules for businesses operating within their management scope. Participating businesses may rely on such unified rules instead of developing separate documentation.
That said, the above exemption ceases to apply if the business engages in processing activities that fall outside the scope of the relevant platform rules or unified rules.
(5) Simplified compliance audits
The Provisions substantially reduce compliance audit obligations required under the PIPL. Instead of conducting full-scale personal information protection compliance audits, small-scale personal information handlers are generally only required to complete a simplified self-assessment checklist (set out in an appendix to the Provisions) at least once every five years, and retain the records for at least five years.
In addition, small-scale personal information handlers that obtain a recognized personal information protection certification may be exempt from audit requirements during the certification period.
Notably, these simplifications do not apply to the processing of personal information of minors under the age of 14. All personal information handlers that process such personal information must continue to conduct annual compliance audits relating to such processing.
(6) Simplified Personal Information Protection Impact Assessment (PIPIA)
The Provisions also introduce a simplified PIPIA template. Rather than preparing a comprehensive assessment report, small-scale handlers may complete a standardized assessment form (set out in an appendix to the Provisions) and retain it for at least three years.
In addition, where a qualified small-scale personal information handler is entitled to rely on an online platform under the circumstances described in paragraph (4) above, and the platform’s compliance audit or PIPIA already covers the handler’s personal information processing activities conducted through the platform, the small-scale handler is not required to conduct a separate compliance audit or PIPIA in respect of those activities.
3. Limited facilitation for cross-border personal information transfers
The Provisions do not materially change the existing regulatory framework of cross-border data transfer for small-scale personal information handlers. The current rules remain largely unchanged for small-scale personal information handlers. These Include requirements for:
Providing notices related to the transfer
Obtaining data subject specific informed consent for the transfer
Restricting the export only to the personal data that is strictly necessary for the legal bases
Conducting CAC filings and security assessments
While the Provisions do not create new relaxation from China’s cross-border data transfer requirements, they introduce a slightly streamlined review process for small-scale personal information handlers. Where a CAC security assessment is required, the competent provincial-level cyberspace administration authority will conduct an initial review and submit its assessment recommendation to the CAC for final approval. This contrasts with the existing process, under which applications are submitted directly to the CAC for review.
4. Penalty exemption and mitigation
The Provisions adopt a more lenient regulatory approach towards small-scale personal information handlers by expressly recognizing circumstances where penalties may be reduced or waived.
(1) Circumstances where penalties may be waived
Administrative penalties will generally not be imposed where (i) the violation is minor, promptly corrected and causes no harmful consequences; or (ii) the handler can demonstrate that it was not at fault.
In addition, regulators may, at their discretion, refrain from imposing administrative penalties where the violation is a first-time offence, results in only minor consequences and is promptly rectified.
Even where no administrative penalty is imposed, regulators may still adopt supervisory measures, such as regulatory interviews or reminder notices.
(2) Circumstances supporting reduced penalties
A lighter penalty should be imposed where the handler:
Voluntarily eliminates or mitigates harmful consequences
Proactively discloses violations not yet discovered by regulators
Promptly notified affected individuals, took remedial measures and proactively reported the incident to the relevant authorities following a personal information security incident
Provides significant assistance during regulatory investigations
5. Takeaways
The Provisions mark an important shift towards a more proportionate compliance framework under China’s personal information protection regime. By introducing simplified requirements for privacy policies, notices, consent, audits and impact assessments, the new rules should significantly reduce compliance costs for small businesses.
At the same time, the Provisions preserve enhanced protections for sensitive personal information and minors’ personal information, indicating that regulators remain committed to safeguarding higher-risk categories of data, while easing compliance burdens for lower-risk processing activities.
For more information, please feel free to reach out to Lindsay Zhu or Scott Warren.
