China's Cyberspace Administration Seeks Comments on Draft Rules for Large Personal Information Processors

The Cyberspace Administration of China (CAC) has issued the Provisions on Personal Information Protection for Large Personal Information Processors (Draft for Comments) for public consultation. The draft is formulated in accordance with the Personal Information Protection Law of the People's Republic of China, the Regulations on the Administration of Network Data Security, and other laws and administrative regulations, aiming to regulate the personal information processing activities of large personal information processors, protect the legitimate rights and interests of individuals' personal information, and promote the lawful and reasonable use of personal information. The CAC has consolidated and improved the previously published drafts of the Provisions on the Establishment of Personal Information Protection Supervisory Committees by Large Online Platforms and the Provisions on Personal Information Protection by Large Online Platforms to form the current draft. Public comments may be submitted by email or letter by September 7, 2026.

The draft specifies the criteria for identifying large personal information processors, including processing personal information of more than 10 million natural persons, providing important network services that involve personal information processing, or having a significant impact on national security, economic operation, social stability, public health and safety. Eligible entities should apply to the national cyberspace administration through the provincial cyberspace administration at their location, which will complete a completeness check within 15 working days. The CAC, together with the telecommunications authority and public security department under the State Council, will research and determine the list of large personal information processors and publicly announce it. Entities that no longer meet the criteria for six consecutive months may apply to change their designation.

Regarding personal information protection measures, the draft requires large personal information processors to adopt measures such as encryption, de-identification, access control, and anonymization to ensure the security of the personal information they process. They may use the national public service for network identity authentication, and are encouraged to use data label identification technology, obtain personal information protection certification, and raise the level of protection. The draft also encourages innovation in relevant technologies, products, and services, participation in the formulation of international standards and rules, and promotion of mutual recognition of rules with other countries and regions. For overseas organizations or individuals that engage in processing activities that infringe upon the personal information rights and interests of Chinese citizens or endanger national security or public interests, the CAC may include them in a list of entities for which providing personal information is restricted or prohibited, and take corresponding measures.

The draft contains specific provisions on personal information processing rules. It requires that the collection of personal information follow the principle of minimal necessity and that excessive collection be prohibited. Separate consent is required for processing sensitive personal information, providing or disclosing personal information to others, and providing personal information abroad. Processing personal information of minors under the age of 14 requires the consent of their guardians, and a convenient channel for withdrawing consent must be provided. If the purpose, method, or type of processing changes, consent must be obtained anew. Large personal information processors must store personal information collected and generated in their domestic operations within China, and select qualified data centers, including those established within China with legal representatives of Chinese nationality. Data center management institutions must establish internal management systems and emergency response plans, and promptly remediate and report security defects or security incidents.

When personal information is aggregated or fused, if the resulting information meets the criteria for sensitive personal information, it shall be identified and protected as sensitive personal information.