On 7 August 2026, the Cyberspace Administration of China opened public consultation on the Provisions on Personal Information Protection by Large Personal Information Processors (Draft for Comment), with comments due by 7 September 2026. The draft did not appear out of nowhere — the cyberspace authority consolidated and refined two previously published drafts, on the establishment of personal information protection supervisory committees by large online platforms and on personal information protection by large online platforms, into this version. The name changed from “large online platform” to “large personal information processor”, and the regulatory target shifted from “platform” to operators defined by data scale and impact. For AI companies processing personal information at a certain scale, this list of obligations needs to be checked in advance.

From “large online platform” to “large personal information processor”

Both earlier drafts took “large online platform” as their object, anchored in the platform ecosystem. The consolidated version changes the handle: the threshold is no longer “is it a platform” but the scale and impact of personal information processing.

That change matters. Many AI applications are not platforms in the traditional sense — they are model services, tool software and vertical applications, yet they process personal information at scale. Drawing the line by data scale rather than platform attributes brings these operators into scope, making the rules more complete and better matched to the shape of the AI industry.

Who can be designated a “large personal information processor”

Article 2 of the draft sets out the designation criteria, to be weighed across three conditions:

(1) processing the personal information of more than 10 million individuals;

(2) providing important network services involving personal information processing, or having a business scope covering multiple activities involving personal information processing;

(3) personal information processing activities that have an important impact on national security, economic operation, social stability, public health and safety, among others.

The three conditions are listed side by side and assessed comprehensively by the designating authority. The 10-million threshold is not out of reach for many public-facing AI applications — a consumer app with a stable user base, or a nationwide industry SaaS, may well touch it on processing scale.

Designation is not automatic: filing, review and published list

Inclusion follows a “file — review — publish list” path rather than automatic application on crossing the threshold. Article 3 establishes the full mechanism:

Operators processing the personal information of more than 10 million individuals, and those that self-assess as meeting the second and third conditions, must file for designation with the national cyberspace authority through the provincial cyberspace authority where they are located. The provincial authority completes a completeness review within 15 working days of receiving the filing materials and forwards complete materials to the national authority; where materials are incomplete, it notifies the operator of the additional materials needed in one go.

For those that meet the conditions but do not file proactively, the cyberspace authorities at or above the provincial level, the telecommunications authorities and public security organs may prompt them to file. The national cyberspace authority, together with the State Council telecommunications authority and public security organs, ultimately determines the list and publishes it. A designated operator that considers it no longer meets the conditions for six consecutive months may apply to change its designation.

This design has a practical implication: inclusion depends on filing and designation, not the operator’s own judgement. Companies must first complete a self-assessment and then decide whether to file — which means they must first be able to calculate how many people’s information they process and which important services are involved.

Chapter 2 refines the processing rules, several of which go markedly beyond the general requirements of the Personal Information Protection Law:

Public rules must be itemised. Article 10 requires a structured list of the purpose, method, type and permission names and frequency for each function’s collection and use of personal information; embedded SDKs must be listed with package name, version, operator and access route to processing rules; and external provision must list recipient information.

Situations requiring separate consent are expressly enumerated. Article 11 provides that providing information to other processors, providing it overseas, making it public and processing sensitive personal information require separate consent; processing the information of minors under 14 requires guardian consent and a convenient channel for consent and withdrawal.

Automated decision-making must offer an “off” option. Article 17 requires an easy-to-understand, easy-to-access and easy-to-operate option to switch off personalised recommendations; once switched off, the information must no longer be used for personalised recommendations, and a function to delete user tags must be provided.

In addition, Articles 13 and 14 require personal information collected and generated in domestic operations to be stored domestically, and impose conditions on the location of data centres and the nationality of their actual controllers; Article 19 requires qualifying requests to transfer personal information to be completed within 30 working days in a common or machine-readable format; and Article 21 requires logs of external provision of personal information to be kept for at least six months. On data export, Article 20 requires filing a security assessment, concluding standard contracts or obtaining protection certification as applicable, and assessing the overseas recipient, with provision suspended where it cannot perform.

The obligations chapter: officer, social responsibility report and impact-assessment filing

Chapter 3 sets out organisational and institutional obligations — the part that distinguishes this draft from ordinary data-compliance requirements:

Article 25 requires a member of management to be designated as personal information protection officer, with contact details made public. Article 26 gives the officer fairly specific duties, one of which is notable — where the operator fails to address compliance opinions without justification, or the outcome violates laws and regulations, the officer may report directly to the provincial cyberspace authority. This is an internal “upward channel”, meaning the officer is not a nominal role.

Article 30 requires an annual personal information protection social responsibility report for the previous year, published in the first half of the year, covering nine items including organisational structure, capacity building, protection measures and results, minors protection, handling of rights requests, performance of the supervisory committee and handling of major security incidents.

Article 31 requires a personal information protection impact assessment before launching products, services or features involving automated decision-making, sensitive personal information processing or other activities that may significantly affect individual rights, and filing of the assessment report with the national cyberspace authority through the provincial authority within 15 working days of completion.

At the institutional level, Article 24 lists seven mandatory internal management systems, including classified management, secure storage and behaviour auditing, monitoring and emergency response, impact assessment and compliance auditing, minors protection, complaints and reports, and education and training; Article 28 requires operation records and permission-approval records to be kept for at least six months, and impact assessment reports and processing records for at least three years.

What this means for AI companies

For AI companies processing personal information at the tens-of-millions scale, three points.

First, take stock of scale and self-assess. Whether the designation conditions are triggered depends on a combined judgement across processing volume, service type and impact, and all three need internal data. Without a clear picture of scale, there is no way to tell whether filing is needed.

Second, treat the “officer” and “impact assessment” as long-term mechanisms rather than one-off actions. The officer’s independent reporting right and the filing requirement for impact assessment reports both point to continuously operating internal governance rather than one-off materials for an inspection. Adjacent to impact assessment is the Network Data Security Risk Assessment duty for important data processors; for related background, see our Data Compliance and Multi-Jurisdiction Compliance services.

Third, plan data export and external provision in advance. Domestic storage, log retention and export assessment stack up and directly affect product architecture and technology choices; the later they are handled, the higher the retrofit cost.

The provisions remain a draft for comment, and the final scope and details of obligations may change. But the approach of tiering responsibility by data scale is now clear, and companies with large processing volumes should align to the current direction in advance.

This article is based on the Provisions on Personal Information Protection by Large Personal Information Processors (Draft for Comment) published on 7 August 2026 by the Cyberspace Administration of China. It is for reference only and does not constitute legal advice. Specific compliance judgements should be based on the text in force and applicable law.