#
A mature, enacted omnibus statute (PIPL) with implementing regulations and an active, multi-agency enforcement apparatus is in force.
Sub-modules (5)
Regulator And AuthorityGreen
CAC is the lead/coordinating supervisory authority; MIIT, MPS, SAMR and financial regulators exercise delegated enforcement in their respective domains, unlike the single-authority models of GDPR/CPRA.
Claims (1):
- The PIPL confers enforcement authority jointly on multiple governmental departments — CAC, MIIT, the Ministry of Public Security, SAMR and financial regulators, plus local counterparts — with CAC taking a leading and coordinating role rather than acting as a single unified supervisory authority as under GDPR or CPRA.
Act And InstrumentsGreen
The CSL/DSL/PIPL triad forms the statutory core, implemented via the Network Data Security Management Regulations (eff. 1 Jan 2025) and numerous CAC secondary rules.
Claims (1):
- China's data governance framework rests on three national laws (CSL 2017/amended 2025, DSL 2021, PIPL 2021), implemented at national level via the Regulations on Network Data Security Management, effective 1 January 2025.
Material ScopeGreen
PIPL governs personal information handling activities undertaken by personal information handlers and entrusted parties (the processor-equivalent concept).
Claims (1):
- PIPL is China's first comprehensive data protection legislation and regulates personal information handling activities by personal information handlers and entrusted parties.
Territorial ScopeGreen
Article 3 gives PIPL extraterritorial reach, analogous to GDPR Art 3(2), covering overseas handling aimed at providing products/services to, or analyzing/assessing the behavior of, individuals in China.
Claims (1):
- PIPL Article 3 extends its territorial scope to the handling of personal information conducted outside China where the purpose is to provide products or services to, or to analyze/assess the behavior of, individuals located in China, or other purposes specified by law.
Regulator Registration And FilingAmber
Offshore handlers caught by Article 3 must establish a dedicated office or appoint a representative in China and report identifying details to the competent authority (Art 53).
Claims (1):
- Offshore personal information handlers subject to PIPL under its extraterritorial provisions must establish a dedicated office or appoint a designated representative in China for personal information protection purposes (Art 53).
Regulator & Framework
China's personal information protection framework tightened for small processors and remains in active drafting for large processors this cycle. The Provisions on Simplified Measures for Personal Information Protection by Small Personal Information Processors, Order No. 25, jointly issued by the Cyberspace Administration of China and the Ministry of Public Security, was adopted at the 14th Office Meeting of 2026 of the Cyberspace Administration of China on 26 June 2026, promulgated on 22 July 2026, and entered into force on 1 September 2026. It is the first PRC departmental rule specifically addressing processors handling the personal information of fewer than 100,000 individuals, establishing a dedicated compliance track for small-scale processors rather than requiring them to meet the same obligations as larger entities.
At the upper end of the processor-size spectrum, the draft Large Personal Information Processor Provisions remain at the consultation stage. Public comment opened on 7 August 2026 and the feedback window closed on 7 September 2026; the draft consolidates two earlier 2025 drafts into a single consultation text. As of 11 October 2026, no finalized version of the Provisions has been located, so the obligations it would impose on large processors remain prospective rather than binding.
Taken together, these two instruments describe a regulator pursuing a tiered compliance-burden strategy: relieving small processors of heavier obligations via Order No. 25 while developing a materially more demanding regime for large processors that has not yet taken legal effect. The small-processor relief measure is now a binding, in-force instrument; the large-processor regime remains, as of this cycle, a proposal at the consultation stage, and the two should not be conflated in terms of their present legal force.
Outlook
The principal item to watch is whether the Large Personal Information Processor Provisions are finalized and promulgated, and on what timeline. Regulatory-horizon tracking places expected finalization in the fourth quarter of 2026, carrying a half-year uncertainty band given the instrument's current consultation status; this estimate should be read as provisional until a dated promulgation notice appears. Until finalization, large processors operate without the specific minimum-necessity and internal-management obligations the draft would introduce, continuing instead under the general Personal Information Protection Law baseline.
1 earlier distinct update(s)
Regulator & Framework
Enforcement authority in China's data-protection landscape remains distributed across the Cyberspace Administration of China, the Ministry of Public Security and the State Administration for Market Regulation, a standing structural feature rather than a new development this cycle. What is new is the amended Cybersecurity Law, effective 1 January 2026, which is reported to constitute the most substantial amendment to the CSL since its original 2017 adoption. The amendment's most consequential feature for the regulator-and-framework module is its broadening of overseas-conduct enforcement beyond the law's former scope, which had been limited to conduct endangering critical information infrastructure. This is a genuine territorial-scope expansion, not a restatement: overseas conduct that does not touch critical information infrastructure may now fall within the amended law's enforcement reach, a materially broader jurisdictional claim than the pre-amendment framework asserted.
This territorial expansion sits within a distributed-authority structure in which no single regulator holds exclusive enforcement power, meaning that the amended CSL's broadened scope will likely be operationalised through coordinated action across the three named bodies rather than through a single regulator's independent enforcement programme. The evidence base for the amendment's content and its territorial-scope implications derives from secondary legal-commentary sources rather than direct retrieval of the primary amended statutory text, a limitation that should be borne in mind when assessing the precision of the scope-expansion claim.
Outlook
Watch for primary-text confirmation of the amended CSL's exact territorial-scope language, which would allow more precise assessment of how far beyond critical-information-infrastructure conduct the new overseas-enforcement reach actually extends. Watch also for the first enforcement action under the amended law against an entity with no critical-information-infrastructure nexus, which would be the clearest practical test of the new scope.
1 further periodic run re-emitted the standing brief unchanged and is not shown.
Sources and claims (5)
- ProbableIAPP — The PIPL confers enforcement authority jointly on multiple governmental departments — CAC, MIIT, the Ministry of Public Security, SAMR and financial regulators, plus local counterparts — with CAC taking a leading and coordinating role rather than acting as a single unified supervisory authority as under GDPR or CPRA.observed
- ProbableIAPP — China's data governance framework rests on three national laws (CSL 2017/amended 2025, DSL 2021, PIPL 2021), implemented at national level via the Regulations on Network Data Security Management, effective 1 January 2025.observed
- ProbableOneTrust DataGuidance — PIPL is China's first comprehensive data protection legislation and regulates personal information handling activities by personal information handlers and entrusted parties.observed
- ProbableIAPP — PIPL Article 3 extends its territorial scope to the handling of personal information conducted outside China where the purpose is to provide products or services to, or to analyze/assess the behavior of, individuals located in China, or other purposes specified by law.observed
- ProbableIAPP — Offshore personal information handlers subject to PIPL under its extraterritorial provisions must establish a dedicated office or appoint a designated representative in China for personal information protection purposes (Art 53).observed