On 24 July 2026 the Cyberspace Administration of China issued the Provisions on Simplified Measures for Personal Information Protection by Small Personal Information Processors. The Provisions respond to a long-standing gap: the duty standards set by the Personal Information Protection Law are feasible for large enterprises but often too heavy for small processors.
The approach is not to lower the level of protection but to “do subtraction” on the duties — simplifying how they are performed without weakening protection.
Who is a “small personal information processor”
The Provisions are aimed at smaller-scale personal information processors. For most AI startups and SMEs, this identification directly determines whether the streamlined measures apply. The core test usually rests on the volume and type of personal information processed and the scale of the business, rather than simply the number of employees or revenue.
Note that once processing scale grows, or sensitive personal information reaches a certain level, the streamlined path may no longer apply. See our article on new duties for “large personal information processors”.
Which steps are simplified
The streamlined measures cover the whole personal information processing workflow.
Publishing processing rules. The requirement to formulate and publish personal information processing rules is simplified, reducing the compliance-documentation burden on small teams.
Notice duties. Subject to ensuring user awareness, the content and form of notice are simplified.
Obtaining consent. The process for obtaining personal consent is simplified.
Rights response. The way requests from individuals exercising their rights are handled is simplified.
Deletion of personal information. The operational requirements for deletion are simplified.
Simplification is not exemption. The core duties remain; only the manner of performance is better suited to small teams.
Cross-border exemption: a checklist-style arrangement
The most valuable part of the Provisions is that they clarify the conditions under which a small processor is exempt from filing a cross-border data security assessment, concluding a standard contract for personal information export, or obtaining personal information protection certification.
The exemption covers high-frequency, everyday scenarios — cross-border shopping, cross-border delivery, cross-border remittance, cross-border payment, cross-border account opening, flight and hotel booking, visa processing, examination services and the like. For teams making cross-border mini-programs and cross-border tool products, this list essentially draws the boundary of “no heavy process needed”.
But the exemption is conditional: it targets specific situations such as “concluding or performing a contract to which the individual is a party”. Beyond the list, the ordinary cross-border compliance path still applies. See our Multi-Jurisdiction Compliance service page.
Three points for small teams
First, confirm whether you fall within the “small” scope, then decide between the streamlined and ordinary paths. Second, put the streamlined measures into actual processes — published processing rules and simplified notice and consent mechanisms must be reflected in the product and privacy policy. Third, when relying on the cross-border exemption, keep evidence that the exemption conditions are met, to avoid being unable to explain later. See our Data Compliance service page.
This article is based on the Provisions on Simplified Measures for Personal Information Protection by Small Personal Information Processors issued by the Cyberspace Administration of China on 24 July 2026. It is for reference only and does not constitute legal advice.