On 7 August 2026 the Cyberspace Administration of China (CAC) published a draft of the Provisions on Personal Information Protection by Large-Scale Personal Information Processors and opened it for comment until 7 September. The CAC notice says the draft consolidates two earlier drafts from 12 September 2025: one on oversight committees for large network platforms and one on personal information protection by large platforms. Reed Smith summarises the draft as covering entities that process the data of 10 million or more people and meet further tests on the scale of their services. I could not confirm whether a final version has been issued, so everything below concerns the draft.
The strongest case for the draft
A fair reading starts with what the draft tries to fix. Platforms holding the data of tens of millions of people create risks that a generic compliance checklist does not handle well. Users cannot negotiate with a dominant app. Third-party merchants and mini-programs inside a platform can misuse data that the platform enabled them to collect. Article 58 of the Personal Information Protection Law (PIPL) already points at this problem for large platforms. The new draft turns that principle into operating detail.
According to the CAC text, a large processor must set up a personal information protection oversight committee within six months of designation (Art. 37). The committee must have at least seven members, at least two-thirds of them external. Large processors must also act at once when a service provider on their platform seriously violates the law (Art. 29), and publish an annual personal information protection social responsibility report (Art. 30). Per Reed Smith, a senior-management protection officer is required, and complaints must be resolved within 15 working days.
Those are not unreasonable ideas. Independent oversight, platform duties toward third-party operators and public reporting echo mechanisms that Western regulators and civil society have long asked of large platforms. Where the EU's General Data Protection Regulation relies mostly on a data protection officer and regulators' after-the-fact enforcement, a standing external committee is a structural experiment worth watching.
Where proportionality strains
The draft is less convincing on three points.
First, designation is administrative and broad. Reed Smith reports three criteria: 10 million individuals, significant internet-based services or multiple lines of business involving personal information, and a significant impact on national security, economic operations, social stability or public health and safety. The last test is open-textured. China Briefing reports that firms apply through provincial cyberspace authorities, with the CAC making the final call. A bright-line size test lets a firm plan. A discretionary "social stability" test lets the regulator decide who is in scope after the fact, which makes investment in a new product line harder to price.
Second, the localisation rules go beyond data protection. Both Reed Smith and China Briefing report that data centres holding the data must be located in mainland China and that the legal representative or actual controller of the data-centre operator must be a Chinese citizen. China Daily adds that the draft contemplates restrictions on providing personal information to foreign organisations or individuals that harm Chinese citizens' rights or endanger national security. A requirement about the nationality of a data-centre controller does nothing to protect an individual's privacy. It limits which cloud and hosting providers a platform may use, which weakens competition among them and raises costs that smaller platforms near the threshold will feel hardest.
Third, an oversight committee is only as independent as its appointment and filing process. Reed Smith notes that the committee's operating rules and membership are filed with the CAC, and that the regulator can order a non-functioning committee dissolved. Independence that the regulator can end is closer to supervised self-governance. That may still improve outcomes, but it should not be sold as a counterweight to state power. Users' main privacy risk in China, as elsewhere, includes government access to data, and a committee of outside experts cannot address that.
The two-tier design is the better idea
The more promising feature of the PIPL regime is how it scales duties with size. The CAC and the Ministry of Public Security jointly issued simplified measures for small-scale processors on 22 July 2026, effective 1 September 2026, according to the HKU Data Protection Office. They cover processors handling data on fewer than 100,000 people, with simplified notice and consent, longer audit cycles, standard self-assessment templates and platform-level compliance, as well as clearer grounds for penalty exemption for minor, first-time or promptly corrected violations.
That is sensible regulation. A neighbourhood app and a national super-app should not face the same paperwork. The risk now sits in the gap between 100,000 and 10 million people. Mid-sized firms there face the full general PIPL regime, and the draft gives them no guide on what they would need to do to be designated, or to avoid it.
What to watch
Three questions will decide whether the final rule is proportionate:
- Does the text narrow the "significant impact" test to measurable indicators?
- Does the nationality requirement for data-centre controllers survive in the final text, and how does it interact with the existing cross-border transfer routes Reed Smith describes (security assessment, standard contract, certification)?
- Does the oversight committee get published reporting duties that outsiders can use to hold the processor to account?
The lesson for other jurisdictions is narrow. Tying heavier duties to scale, and pairing them with relief for small firms, is a design that travels. Using data-protection rules to dictate who may own the servers does not, and it undermines an otherwise reasonable accountability framework.