State Internet Information Office and Ministry of Public Security jointly announced the "Provisions on Simplified Measures for the Protection of Personal Information by Small-scale Personal Information Handlers"

Recently, the Cyberspace Administration of China and the Ministry of Public Security jointly issued the "Regulations on Simplified Measures for Personal Information Protection by Small Personal Information Handlers" (hereinafter referred to as the "Regulations"), which will be implemented starting from September 1, 2026. A relevant official from the Cyberspace Administration of China stated that the "Personal Information Protection Law" stipulates that the Cyberspace Administration should coordinate with relevant departments to establish specific rules and standards for the protection of personal information by small personal information handlers. The formulation of the "Regulations" is an important measure to implement the decisions and arrangements of the Central Committee of the Communist Party of China, and to fulfill the relevant requirements of the "Personal Information Protection Law." It is beneficial for upholding the bottom line of personal information security while reducing compliance costs for small personal information handlers, enhancing the level of personal information protection, and providing legal protection for innovation and development of small and medium-sized enterprises. The "Regulations" clarify the scope of application and general requirements. The Regulations apply to the protection of personal information by small personal information handlers within the territory of the People's Republic of China. Small personal information handlers are defined as those who handle personal information of fewer than 100,000 individuals. The Regulations support small personal information handlers in complying with relevant laws, regulations, and national provisions on personal information protection, and taking simplified measures that are proportionate to the scale and capabilities of the handlers to ensure personal information security and protect individual rights. The "Regulations" specify simplified measures for personal information processing rules, among others. They stipulate simplified measures for small personal information handlers to establish public personal information processing rules, fulfill notification obligations, obtain individual consent, handle requests from individuals exercising their rights, delete personal information, etc. It is also clarified that small personal information handlers providing personal information to overseas entities are exempt from reporting data export security assessments, entering into personal information standard contracts, or obtaining personal information protection certifications. The "Regulations" specify simplified measures for fulfilling obligations by small personal information handlers. They specify simplified measures for small personal information handlers to conduct compliance audits, privacy impact assessments, establish personal information protection management systems, fulfill obligations for remedying and notifying personal information security incidents, etc. It is also specified that small personal information handlers who have obtained personal information protection certifications may be exempt from conducting compliance audits during the validity period of the certification. The "Regulations" specify supervision and management requirements. They specify situations where penalties are not imposed on small personal information handlers, or where penalties are lighter or mitigated. They also support enterprises, relevant social organizations, professional institutions, etc., in helping small personal information handlers enhance their personal information protection capabilities, and encourage departments responsible for personal information protection to reduce the compliance costs for small personal information handlers. The Regulations state that the Cyberspace Administration, public security organs, and other departments responsible for personal information protection may conduct supervision and inspections of small personal information handlers to ensure compliance with personal information protection obligations. It also clarifies the legal liabilities for violations and the implementation time frame. The "Regulations" provide the "Self-Examination Form for Compliance Audit of Personal Information Protection by Small Personal Information Handlers" and the "Impact Assessment Form for Personal Information Protection by Small Personal Information Handlers" in the form of annexes, facilitating small personal information handlers to conduct compliance audits and privacy impact assessments on their own. This article is reprinted from the official account of "Cyberspace China," GMTEight Editor: Liu Jiayin.