On 24 July 2026, the Cyberspace Administration of China (CAC) and the Ministry of Public Security (MPS) jointly issued the Provisions on Simplified Measures for Personal Information Protection by Small Personal Information Processors (hereinafter referred to as the Provision), which takes effect on 1 September 2026. The Provisions implement Article 62 of the Personal Information Protection Law (PIPL), which authorizes the CAC to formulate dedicated rules for small-scale personal information (PI) handlers. Both the Provisions and the CAC's accompanying Q&A make clear that the measure is part of a broader policy push to support micro, small and medium-sized enterprises by lowering compliance costs while holding the bottom line on PI security. In scope, the Provisions apply to PI handlers located in China that process the PI of fewer than 100,000 individuals, counted by the cumulative number of natural persons whose PI is currently held, excluding deleted records.
Read More