China's Cyberspace Administration (CAC) opened public consultation on 7 August 2026 on draft rules for large-scale personal information processors, and it closed on 7 September 2026. The final text has not been published. Even so, the draft shows where Beijing's data governance is heading. It does not add a new data-export gate. It narrows who may physically host the data and who may supervise the companies that hold it.
What the draft does
According to Reed Smith's analysis, the draft targets handlers that process the personal information of 10 million or more individuals and run significant internet services or multiple business lines. Their processing must also significantly affect national security, the economy, social stability, or public health and safety. Qualifying firms self-assess and apply to the CAC for designation. The CAC can also require an entity to apply, and it will publish a list of designated handlers.
Designation brings three main obligations:
- A supervisory committee. It needs at least seven members, with external members making up no less than two-thirds of the total and an external member in the chair. Its rules and membership are filed with the CAC.
- A personal information protection officer. This senior manager can report to the provincial CAC if concerns go unaddressed.
- Data-centre conditions. Qualifying data centres must be physically in mainland China. Their legal representative or ultimate controller must be a PRC national.
China Briefing's summary adds that the committee must be set up within six months of designation. It oversees 11 areas, including export compliance, automated decision-making and impact assessments. China Briefing's reading is that the draft sets out no new cross-border transfer rules and restates existing duties. Reed Smith likewise describes the transfer path as the existing mechanism: a CAC security assessment, the standard contract, or certification.
The case for the regulators
The strongest argument for this approach is practical. A company holding the records of tens of millions of people is a systemic risk, much like a large bank. Independent oversight with external majorities is a governance idea that many Western regulators also admire. A mandatory officer with a direct line to a regulator can catch problems before breaches happen. Voluntary privacy programmes have often failed to do that. Requiring the committee to cover sensitive and minors' data answers a real gap.
Where proportionality breaks down
The weakness is in the data-centre conditions and the layering of overlapping regimes, not the oversight idea.
The localisation duty itself is not new. Article 40 of the Personal Information Protection Law, as translated by Prighter, requires critical information infrastructure operators, and processors above a threshold set by the CAC, to keep personal information collected in China inside China. Overseas provision requires a CAC-organised security assessment unless rules say otherwise. The amended Cybersecurity Law has applied since 1 January 2026. The European Commission's IP Helpdesk summary reports that it raises fines to as much as 10 million yuan and widens extraterritorial reach. The draft therefore adds a third layer: where the servers must be, and who controls them.
That layer matters because the 2024 reform pointed the other way. The CAC's Provisions on Promoting and Regulating Cross-Border Data Flows, issued 22 March 2024, exempted non-CII operators that had cumulatively sent fewer than 100,000 individuals' non-sensitive personal information abroad since 1 January of the year. They set a standard-contract or certification tier for 100,000 to under 1 million individuals. A security assessment applies from 1 million, or from 10,000 sensitive records. It was a calibrated, volume-based, risk-sensitive design, and it was explicitly framed as promoting data flows. A large-scale processor that is designated under the new draft will still enjoy those exemptions on paper. In practice it must also satisfy a regulator-supervised committee and a data-centre test that is not scaled to the risk of any given transfer.
For open-internet advocates, the concern is cumulative friction. Physical-location and nationality requirements for infrastructure controllers cannot be met by encryption, audits or contractual safeguards. A multinational with a Chinese subsidiary may be able to comply. A foreign cloud or analytics vendor that cannot satisfy the controller condition may be shut out of the largest customers' stacks, and those customers are the ones most likely to need world-class tooling. Where the outcome-based case for localisation is weak, a pro-innovation approach would use the existing assessment and certification tools rather than infrastructure ownership tests.
The 10 million threshold also warrants scrutiny. Reed Smith notes that the CAC can require firms to apply even if they do not volunteer. That discretion, combined with a national-security-and-economy test, makes designation unpredictable. Predictable, objective thresholds, like the volume tiers in the 2024 Provisions, allow companies to plan investment.
What to watch in the final text
Three things will decide whether this is a governance upgrade or a localisation ratchet:
- Whether the data-centre conditions survive unchanged, especially the nationality test for controllers.
- Whether designation stays discretionary or is tied to published criteria that a firm can check itself against.
- Whether the 2024 export exemptions are left intact for designated firms, or quietly narrowed by implementing guidance.
The consultation has closed, but the real test is the final text. If Beijing keeps the oversight committee and relaxes the infrastructure conditions, it will have a defensible model. If it keeps both, the net effect is a heavier compliance stack on exactly the firms that move the most data, with little evidence that location rules protect individuals better than the audit and assessment tools China already has.