Takeaways
- The Cyberspace Administration of China (CAC) proposes to issue the Regulations on Personal Information Protection by Large Personal Information Handlers, substantially raising the compliance requirements for such handlers. The Draft adopts a composite designation standard based on the processing of personal information of at least 10 million individuals, together with the importance of its business and the significance of its impact. Companies must conduct self-assessments and file declarations, with the CAC responsible for designation and publication of the resulting list. Once designated, companies must disclose, in structured lists, details of permission access, SDK information and records of users’ consent to personal information processing. All data must be stored in China in a data center whose legal representative or actual controller must be a Chinese national.
- The Measures for Network Data Security Risk Assessment took effect on August 20, 2026, requiring important data processors to conduct risk assessments annually and submit the risk assessment reports to the relevant competent authorities.
- Data regulation in EU and US continues to take a stringent approach. Temu is suspected of failing to cooperate fully with an inspection under EU’s Foreign Subsidies Regulation. ChatGPT has been designated as a Very Large Online Search Engine, while Reddit and Roblox have been designated as Very Large Online Platforms under the Digital Services Act.
Regulatory Highlights
CAC Proposes Regulations Imposing Stricter Compliance Obligations on Large Personal Information Handlers Processing Personal Information of More Than 10 Million Individuals
CAC consolidated and refined the two previously released drafts, the Provisions on the Establishment of Personal Information Protection Supervisory Committees by Large Online Platforms and the Provisions on Personal Information Protection by Large Online Platforms, into the Regulations on Personal Information Protection by Large-Scale Personal Information Handlers (the “Draft”), inviting public feedback by September 7, 2026. Its main provisions are summarized below:
- Setting the criteria of “personal information of 10 million individuals + important businesses and significant impact,” with enterprises conducting self-assessments and filing declarations, and CAC determining and publishing the results: The Draft adopts a composite identification standard, covering entities that process the personal information of at least 10 million individuals, provide important online services or process personal information across multiple sectors, and have a significant impact on national security, economic operation, social stability, and public security. Companies must assess themselves and file declarations, based on which the national cyberspace authority will make its determinations and publish a list.
- Requiring structured lists of permissions accessed by each function or service, SDK information, and consent records to facilitate withdrawal: Beyond the basic requirements of the Personal Information Protection Law (PIPL) and the Regulations on Network Data Security Management, the Draft introduces additional obligations for large personal information handlers. Privacy policies must present structured lists detailing the name, type and frequency of permissions accessed by each function or service, as well as embedded SDKs information. The Draft also specifies, for the first time, the practical means of facilitating consent withdrawal: providing individuals with a structured list of the types, purposes and methods of processing covered by their consent, enabling them to decide whether to withdraw it.
- Higher data localization and cross-border transfer requirements, including a Chinese nationality requirement for the legal representative or actual controller of the domestic data center: Large personal information handlers must store personal information in a data center established in China that complies with applicable national policies and standards and whose legal representative or actual controller is a Chinese national. When providing personal information overseas, they must not only complete the prescribed ex ante compliance procedures, but also supervise overseas recipients and suspend such provision where necessary.
- Strengthening internal governance and requiring additional impact assessments and regulatory filings before certain product launches: The Draft refines the existing framework by requiring designated large personal information handlers to establish a personal information protection supervisory committee within six months of designation and comply with specified operational requirements. It also requires personal information protection impact assessments before launching certain products or functions, such as those involving automated decision-making or sensitive personal information processing, in addition to biennial compliance audits and annual risk assessments.
- Strengthening regulatory accountability, with regulators empowered to require third-party hosting of personal information: Large personal information handlers must submit the required information to regulators within 30 working days of designation. Regulators may conduct on-site inspections, require corrective action through regulatory interviews, order the dissolution of the supervisory committee, or require personal information to be hosted by a third-party data center.
The Measures for Network Data Security Risk Assessment Took Effect on 20 August 2026
The Measures for Network Data Security Risk Assessments (“Measures”) were adopted on June 1, 2026 and came into effect on August 20, 2026. Under the Measures, important data processors must conduct a risk assessment annually and submit a risk assessment report, while general network data processors are encouraged to conduct a risk assessment at least once every three years. On the day the Measures came into effect, both CAC and the Ministry of Public Security (MPS) responded separately to media questions concerning their implementation and clarified the following matters:
- The Measures provide that risk assessments may be conducted independently or entrusted to a third-party institution and encourage third-party institutions to obtain assessment service certification. Currently, three certification bodies, namely the Data and Technology Support Center of the CAC, the Third Research Institute of the MPS, and Tail Certification Center Co., Ltd., may provide such certification, with the first two officially publishing the corresponding certification rules.
- Important data processors must submit their annual risk assessment reports to the relevant competent authorities within 20 working days after completing the assessments. Where the competent authority is unclear, the reports may be submitted to the provincial cyberspace administration or CAC through the contact details provided by CAC.
- Public security organs are primarily responsible for maintaining dynamic regulatory records of network data processors within their jurisdictions, reviewing and verifying risk assessment reports submitted by important data processors, and urging network data processors posing relatively significant security risks or having experienced data security incidents to commission certified third-party institutions to conduct risk assessments. They will also order rectification where important data processing activities may endanger national security or public interests, and investigate and take enforcement action against unlawful assessment institutions and entities that fail to fulfil their risk assessment obligations.
CAC Personal Information Protection Policy Q&A (August): Non-compliant Processing of Publicly Available Personal Information and Common Causes of Personal Information Breaches
The Q&A primarily addresses two issues:
- Processing publicly available personal information without consent is subject to Article 27 of the PIPL and Article 12 of the Guidelines for Personal Information Protection Compliance Audits, an annex to the Measures for the Administration of Personal Information Protection Compliance Audits. Non-compliance includes using such information for unrelated commercial promotion, cyberbullying, or spreading rumors or false information; processing it despite the individual’s express objection; processing it without consent where it significantly affects the individual’s rights and interests; or collecting, retaining, or otherwise processing it beyond a reasonable scope in terms of scale, duration, or purpose.
- Identifying common causes of personal information breaches, including storing or transmitting personal information in plaintext without appropriate safeguards, such as encryption or de-identification; inadequate protection of systems and databases storing personal information, including weak passwords or no login authentication; ineffective authentication for internet-accessible data interfaces; and public disclosure of login credentials for associated systems and databases. Accordingly, the PIPL requires personal information handlers to establish internal management systems and procedures; classify personal information; adopt encryption, de-identification, and other technical safeguards; properly assign operational permissions; regularly provide security education and training; and develop and implement personal information security incident response plans.
Data Enforcement
On August 7, the Cybersecurity Bureau of MPS released the Measures for the Supervision and Inspection of Cyberspace Security by Public Security Organs (MPS Order No. 176), setting out requirements for activities including online information inspections, information review capability testing, and on-site inspections.
On August 11, the Cybersecurity Bureau of MPS published 10 typical cases involving the crackdown on crimes against citizens’ personal information. The cases primarily concerned illicit and grey-market operations that, for financial gain, purchased, fraudulently obtained, or scraped large volumes of personal information through deception, hacking attacks, insider leaks, and other means.
Since the launch of the 2026 Special Campaigns on Personal Information Protection, the CAC, Ministry of Industry and Information Technology (MIIT) and MPS have inspected more than 20,000 APPs and SDKs, required over 1,000 companies and institutions to rectify their personal information collection practices, conducted risk assessments of more than 90,000 entities in the education, transportation and financial sectors, and ordered the remediation of 12,000 identified risks and deficiencies.
Routine APP supervision has progressed steadily in August. On August 25, MIIT identified 26 APPs and SDKs for infringing upon users’ rights. On August 7, the Guangdong Cyberspace Administration identified 20 locally operated APPs with personal information collection and use issues. On and August 20 and 26, the Shanghai Municipal Communications Administration removed 9 APPs (SDKs) from app stores and identified 16 others for similar violations.
Data Standards
On August 27, State Administration of Market Regulation and Standardization Administration of China approved 60 national standardized guiding technical documents, including a large number of technical requirements relating to artificial intelligence and embodied intelligence.
Industry Development
On August 21, CAC released the Action Plan for Promoting the High-Quality Development of Cyber and Information Enterprises (2026–2030). The Action Plan aims to continuously enhance the overall competitiveness of China’s cyber and information enterprises by 2030 through measures including enterprise cultivation, enhancement of innovation capabilities, industrial upgrading, overseas expansion support, and development of data security protection systems.
On August 29, the China Federation of Internet Societies released the China New E-Commerce Development Report (2026). According to the Report, AI, big data and other technologies accelerated the new e-commerce sector’s intelligent transformation in 2025, while tighter global regulation of data security, intellectual property and taxation drove stronger compliance and deeper localization.
Worldwide News
On July 31, 2026, the European Commission preliminarily found that Temu failed to comply with Commission’s request during its Foreign Subsidies Regulation inspection regarding the provision of organization and management information, IT tools and systems used, and specific books and records in EU. The Commission therefore issued a Statement of Grounds to Temu. Temu may face a fine of up to 1% of its total worldwide turnover in the preceding business year once the infringement is established.
From September 11, 2026, manufacturers subject to the EU Cyber Resilience Act will be required to comply with its first major reporting obligations for actively exploited vulnerabilities and severe security incidents. Manufacturers must submit an early warning within 24 hours and a full notification within 72 hours of becoming aware, underscoring the need to establish appropriate governance structures in advance to ensure timely compliance.
On August 17, Germany’s antitrust authority, the Federal Cartel Office, concluded its investigation into Apple. The authority had previously raised concerns that Apple designed different consent requests for personalized advertising data in its own offerings and third-party APPs. Apple committed to simplifying the consent request architecture for third-party apps within four months and further aligning the format of consent prompts for its own and third-party apps. The commitments will remain in effect for seven years.
On August 26, Meta reached a settlement of up to USD 17.1 billion with 47 U.S. states and several territories, committing to enhance minors’ online safety and personal information protection through measures such as limiting minor’s screen time, enhancing age verification, strengthening parental controls, and implementing age-appropriate content safeguards.
