On 22 July 2026, the Cyberspace Administration of China (CAC) and the Ministry of Public Security jointly issued the Provisions on Simplified Measures for Personal Information Protection by Small-Scale Personal Information Handlers (Simplified Measures), which will take effect on 1 September 2026.
China issues new rules relaxing compliance burdens for small-scale personal information handlers processing personal information of fewer than 100,000 individuals.
Qualified small-scale handlers benefit from simplified notification and consent mechanisms, extended compliance audit cycles, standardised self-assessment templates, and platform-level privacy compliance.
New rules introduce clear grounds for penalty exemption and mitigation for minor, first-time, or promptly corrected violations.
Businesses should assess whether subsidiaries in China fall within scope of small-scale handlers and consider practical steps to benefit from relaxations.