Almost two months on from China’s Provisions on Simplified Personal Information Protection Measures for Small‑Scale Personal Information Processors taking effect, we consider the impact on funds, service providers and other B2B enterprises. In summary, they are shaping up to be a refreshingly business-friendly liberalisation to a privacy regime once seen as unnavigable.
Why the fuss (or the lack of it)?
Launched on 1 September 2026, the small-scale processor rules streamline a range of transparency, governance, audit and accountability obligations under China’s Personal Information Protection Law (PIPL), with the aim of reducing the compliance burden for eligible businesses.
The final rules largely preserve the lighter-touch framework proposed in the draft issued earlier this year. In some respects, however, the regulators – namely, the Cyberspace Administration of China (CAC) and the Ministry of Public Security – have not adopted all of the more generous relaxations set out in the draft. That said, many positives for business remain.
Who qualifies as a small-scale personal information processor?
A personal information processor (or “data controller” in GDPR terminology) operating in mainland China that handles the personal information of fewer than 100,000 individuals qualifies as a “small-scale personal information processor” under the rules.
This data volume threshold is notably distinct from the employee headcount and financial size criteria (turnover and total assets) used to define “small mid-cap enterprises” (SMCs) in the proposed EU Digital Omnibus.
To address questions raised by businesses during the consultation, the CAC has issued an official Q&A clarifying that headcount is measured at the point of assessment based on the number of natural persons whose personal information is being processed; personal information that has already been deleted is excluded from the calculation.
Businesses looking to rely on the simplified regime should therefore monitor their processing volumes on an ongoing basis and keep records supporting their assessment. This will be particularly important for multinational groups whose China-facing operations handle customer, employee and other personal information across multiple systems or business lines.
It is also worth noting that the rules apply on a territorial basis: they are available only to processors located within mainland China. Offshore entities caught by the extraterritorial reach of the PIPL, regardless of the volume of their processing activities, do not appear to benefit from the simplified regime.
Where are the key compliance relaxations?
The final rules retain most of the practical relaxations proposed in the draft. Key features include:
- Lighter-touch transparency. Small-scale processors may satisfy their notification obligations by publishing streamlined processing rules, rather than serving lengthy privacy notices on individuals. This light-touch approach is available where personal information (i) is necessary for the relevant product or service, (ii) does not include sensitive personal information, and (iii) is neither provided to another processor nor publicly disclosed. The streamlined processing rules must be prominently presented (for example, by boldening text, or using larger font sizes or different colours) and easy to access and retain. Following this approach, separate consent is not required where an individual knowingly and voluntarily provides, or assists in providing, personal information necessary to receive the relevant services, after being informed of the published processing rules.
- Shared compliance arrangements. Business parks, industrial bases and commercial property managers may prepare common processing rules for small businesses conducting the same offline activities. Similar relief is available for a small business that processes personal information solely through a network platform (for example, an e-commerce platform) and does not share the information with any processor outside that platform. The business may rely on the platform’s rules and avoid duplicating audits and impact assessments already carried out by the platform, provided those exercises cover its activities. Processing that falls outside the purposes, methods or data categories covered by the platform framework remains subject to separate compliance requirements.
- Simplified governance documentation. Small-scale processors may (i) use the prescribed audit form to conduct a compliance audit at least once every five years, with records to be retained for five years; and (ii) use the prescribed PIPIA form to carry out personal information protection impact assessments, with records to be retained for three years. While streamlined in form, these checklists continue to cover a broad range of substantive PIPL requirements.
Which relaxations have not been adopted?
The most notable step back from the draft relates to the processing of sensitive personal information.
Enhanced requirements for the processing of sensitive personal information under the PIPL continue to apply. Small-scale processors must obtain separate consent to process sensitive personal information and cannot rely solely on an individual knowingly and voluntarily providing that information. A small-scale processor must also explain in its processing rules why the sensitive personal information is necessary and how the processing may affect individual rights. In addition, small-scale processors must adopt dedicated processing rules when handling the personal information of children under 14, which is treated as sensitive personal information under the PIPL.
While certain businesses may still be able to leverage the relaxations of the new rules – enterprises in sectors such as finance, healthcare or childcare will continue to struggle with these rules.
Practical takeaways for multinational clients
With the rules now in force, businesses looking to benefit from the reduced obligations should assesse basis for that assessment. As eligibility depends on the number of individuals whose personal information is currently being processed, that position should be kept under active review as the business grows or its processing activities change.
Importantly, however, we have been reminding clients that the simplified regime does not remove the need for a robust data compliance framework! With implementation rules on data protection compliance audits, new draft rules to enhance requirements for large-scale data processors, and continued enforcement activities around transparency and consent, data breach reporting and cross-border transfer compliance, businesses should continue to monitor these fast-moving developments and strengthen their life-cycle data compliance processes.
Please reach out to our team if you see potential advantages in exploring these new rules.
For further information, please contact:
Alex Roberts, Partner, Linklaters
