China’s 50-Article Draft Privacy Rules for Large Platforms: What Changes

China’s Cyberspace Administration of China (CAC) has opened consultation on a 50-article draft titled the Provisions on Personal Information Protection for Large Personal Information Handlers. Published on 7 August 2026, the proposal consolidates two earlier CAC consultation texts and is not yet effective law.

The draft is aimed at organizations that process personal information at very large scale or whose activities could have significant effects on China’s national security, economy, society, public health or safety. Its practical impact would extend beyond day-to-day data collection: covered organizations would face new registration, storage, cross-border-transfer, reporting and independent-oversight expectations.

Consultation deadline and how to submit comments

Comments must reach the CAC by 7 September 2026. Responses can be sent by email to shujuju@cac.gov.cn or by post to the CAC’s Network Data Management Bureau at 15 Fucheng Road, Haidian District, Beijing 100048. Postal submissions should identify the consultation on the envelope.

Because this is a draft for public comment, organizations should treat its requirements as proposed obligations rather than final compliance duties. Article 50 leaves the effective date blank.

Who would count as a large personal-information handler?

The draft uses a comprehensive assessment rather than relying solely on a numerical threshold. Relevant factors include whether an organization:

• Processes personal information relating to more than 10 million natural persons;
• Provides important online services involving personal-information processing or operates multiple relevant lines of business; and
• Has a material effect on national security, economic operation, social stability, public health or safety.

Organizations processing information about more than 10 million people, as well as those that assess themselves as meeting the broader criteria, would need to apply for designation through the CAC at the provincial level. The national CAC, together with other relevant authorities, would determine and publicly announce the list. Authorities could also require an organization that appears to qualify but has not applied to complete the process.

This means the proposal could reach some influential platforms even where the organization’s user count alone does not settle the question.

Possible restrictions on foreign organizations and individuals

The draft would give the national cyberspace regulator the ability to publicly list foreign organizations or individuals whose personal-information processing activities infringe the rights of Chinese citizens or endanger China’s national security or public interest. Listed entities could face restrictions or bans on receiving personal information from China.

The provision creates a potential compliance consequence for overseas recipients, not only for the Chinese platform transferring the data. It also makes the risk assessment around cross-border data flows broader than a conventional privacy review.

Processing and consent requirements

Covered handlers would be expected to process personal information according to the principles of legality, propriety, necessity and good faith. Collection would need to be limited to information necessary for the relevant product or service and could not be excessive.

Where consent is the legal basis, the draft would require separate consent for several higher-risk activities, including:

• Providing information to another personal-information handler;
• Providing information outside China;
• Making information public; and
• Processing sensitive personal information.

A change to the purpose, method or categories of processing would require renewed consent. The draft also calls for a convenient way for individuals to withdraw consent.

For children under 14, processing would require consent from a parent or other guardian, supported by an accessible mechanism for granting or withdrawing that consent.

Domestic storage and data-center controls

Personal information collected or generated through operations in China would have to be stored within China. The data center would need to be located in China and comply with applicable national policies and standards. Its management body’s legal representative or actual controller would also need to be a Chinese citizen.

The proposal places responsibilities on data-center operators as well. They would be expected to maintain internal controls and incident-response plans, identify and fix security weaknesses, notify the platform and authorities where required, and assist with breach response.

For companies using external infrastructure providers, this would make data-center selection, contracting and operational oversight central parts of the compliance program rather than purely technical or procurement decisions.

Cross-border transfers would remain possible, but constrained

The domestic-storage rule would not automatically eliminate every outbound transfer. The draft contemplates cross-border provision where it is genuinely needed for business, but requires the organization to follow China’s applicable export mechanisms and obtain the required separate consent.

In practice, large handlers would need to distinguish between storing data in China and providing data to an overseas recipient. The former would be the baseline storage requirement; the latter would trigger additional legal and procedural controls.

Stronger internal accountability and reporting

The draft would require a more formal privacy-compliance structure, including a personal-information-protection officer drawn from senior management. Reporting on the proposal also describes conditions for that role, including Chinese nationality, no foreign permanent-residency or long-term-residence status, professional personal-information-protection knowledge and relevant experience.

Other proposed governance measures include:

• Direct compliance structures and clearly assigned responsibility;
• Regular personal-information-protection impact assessments;
• Periodic compliance audits;
• Monitoring of processing activity and security vulnerabilities;
• Risk identification and remediation procedures;
• Effective channels for complaints and for exercising individual rights; and
• An annual public personal-information-protection social-responsibility report.

The draft also emphasizes dedicated safeguards for minors, including practical parental-consent and withdrawal processes.

Independent supervisory committees would be a major structural change

Each covered handler would establish a personal-information-protection supervisory committee to oversee its data-handling practices independently.

The proposed committee would have to:

• Include an odd number of members;
• Have at least seven members;
• Be sized in proportion to the organization’s business and user base;
• Include at least two-thirds external members; and
• Be chaired by an external member with senior personal-information-protection compliance-auditing capability.

External members would need to be independent, reputable and experienced in relevant compliance work. They would generally be limited to serving no more than three large handlers at the same time.

The committee’s responsibilities would include supervising compliance and significant personal-information-protection matters, reviewing policies and high-risk processing, issuing opinions or recommendations, and supporting accountability through reporting and oversight arrangements. The handler would also need to provide sufficient resources for the committee to operate.

This is more than a requirement to appoint a privacy officer. It would create a separate oversight layer dominated by outside members and give privacy governance a formal place in the organization’s accountability structure.

What the draft means for potentially covered organizations

The immediate action is to assess whether the organization could meet either the scale threshold or the broader importance-and-impact criteria, then prepare comments before the 7 September deadline. Companies that may fall within scope should also map:

1. The number and categories of people whose information they process;
2. Their major services, business lines and potential public-interest impact;
3. Where Chinese personal information is stored and who controls the relevant data centers;
4. Consent flows for sensitive data, disclosures, publication and exports;
5. Cross-border-transfer mechanisms and overseas recipients;
6. Senior-management responsibility and audit arrangements; and
7. The independence, membership and resources required for a supervisory committee.

The proposal remains subject to change. Its direction, however, is clear: China is considering a system that treats the largest and most consequential data handlers as organizations requiring heightened operational controls, domestic infrastructure, senior-level accountability and external privacy oversight.