--- title: "China — Regulator & Framework | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/china/regulator-and-framework/ source_html: /jurisdictions/china/regulator-and-framework/index.html description: "China — Regulator & Framework: regulator_and_framework Regulator & Framework 5 sub-modules 5 claims Green ▾ # A mature, enacted omnibus statute (PIPL) with implementing regulations and an active, multi-agency en" generated_at: 2026-10-25T04:46:50Z content_sha256: 0cc655270582be837b1d8900e9c43dd522ca2c9a87eb2718cc2ff610e12907cd generator: "fe-fleet/md-twin@1.0" --- # China — Regulator & Framework | Data Protection Monitor ### D1Regulator & Framework5 sub-modules5 claimsGreen▾# A mature, enacted omnibus statute (PIPL) with implementing regulations and an active, multi-agency enforcement apparatus is in force. Primary framework Personal Information Protection Law (PIPL, 2021) together with the Cybersecurity Law (CSL, 2017/amended 2025) and Data Security Law (DSL, 2021) Supervisory authority [Cyberspace Administration of China (CAC)](https://www.cac.gov.cn/) Traffic-light rationale — Green A mature, enacted omnibus statute (PIPL) with implementing regulations and an active, multi-agency enforcement apparatus is in force. #### Sub-modules (5) #### Regulator And AuthorityGreen CAC is the lead/coordinating supervisory authority; MIIT, MPS, SAMR and financial regulators exercise delegated enforcement in their respective domains, unlike the single-authority models of GDPR/CPRA. Claims (1): - The PIPL confers enforcement authority jointly on multiple governmental departments — CAC, MIIT, the Ministry of Public Security, SAMR and financial regulators, plus local counterparts — with CAC taking a leading and coordinating role rather than acting as a single unified supervisory authority as under GDPR or CPRA. #### Act And InstrumentsGreen The CSL/DSL/PIPL triad forms the statutory core, implemented via the Network Data Security Management Regulations (eff. 1 Jan 2025) and numerous CAC secondary rules. Claims (1): - China's data governance framework rests on three national laws (CSL 2017/amended 2025, DSL 2021, PIPL 2021), implemented at national level via the Regulations on Network Data Security Management, effective 1 January 2025. #### Material ScopeGreen PIPL governs personal information handling activities undertaken by personal information handlers and entrusted parties (the processor-equivalent concept). Claims (1): - PIPL is China's first comprehensive data protection legislation and regulates personal information handling activities by personal information handlers and entrusted parties. #### Territorial ScopeGreen Article 3 gives PIPL extraterritorial reach, analogous to GDPR Art 3(2), covering overseas handling aimed at providing products/services to, or analyzing/assessing the behavior of, individuals in China. Claims (1): - PIPL Article 3 extends its territorial scope to the handling of personal information conducted outside China where the purpose is to provide products or services to, or to analyze/assess the behavior of, individuals located in China, or other purposes specified by law. #### Regulator Registration And FilingAmber Offshore handlers caught by Article 3 must establish a dedicated office or appoint a representative in China and report identifying details to the competent authority (Art 53). Claims (1): - Offshore personal information handlers subject to PIPL under its extraterritorial provisions must establish a dedicated office or appoint a designated representative in China for personal information protection purposes (Art 53). Category narrative 97 words China's data protection regime rests on three interlocking national laws — the Cybersecurity Law (CSL, 2017, amended 2025), the Data Security Law (DSL, 2021) and the Personal Information Protection Law (PIPL, 2021, in force 1 Nov 2021) — supplemented by the Network Data Security Management Regulations (effective 1 Jan 2025). The Cyberspace Administration of China (CAC) holds the lead coordinating role but enforcement authority is shared across MIIT, the Ministry of Public Security, SAMR, financial regulators and their local counterparts. Material scope covers 'personal information handlers' and 'entrusted parties' (processor-equivalent), and the regime has explicit extraterritorial reach. Periodic update · new data 2026-10-12 #### Regulator & Framework China's personal information protection framework tightened for small processors and remains in active drafting for large processors this cycle. The Provisions on Simplified Measures for Personal Information Protection by Small Personal Information Processors, Order No. 25, jointly issued by the Cyberspace Administration of China and the Ministry of Public Security, was adopted at the 14th Office Meeting of 2026 of the Cyberspace Administration of China on 26 June 2026, promulgated on 22 July 2026, and entered into force on 1 September 2026. It is the first PRC departmental rule specifically addressing processors handling the personal information of fewer than 100,000 individuals, establishing a dedicated compliance track for small-scale processors rather than requiring them to meet the same obligations as larger entities. At the upper end of the processor-size spectrum, the draft Large Personal Information Processor Provisions remain at the consultation stage. Public comment opened on 7 August 2026 and the feedback window closed on 7 September 2026; the draft consolidates two earlier 2025 drafts into a single consultation text. As of 11 October 2026, no finalized version of the Provisions has been located, so the obligations it would impose on large processors remain prospective rather than binding. Taken together, these two instruments describe a regulator pursuing a tiered compliance-burden strategy: relieving small processors of heavier obligations via Order No. 25 while developing a materially more demanding regime for large processors that has not yet taken legal effect. The small-processor relief measure is now a binding, in-force instrument; the large-processor regime remains, as of this cycle, a proposal at the consultation stage, and the two should not be conflated in terms of their present legal force. #### Outlook The principal item to watch is whether the Large Personal Information Processor Provisions are finalized and promulgated, and on what timeline. Regulatory-horizon tracking places expected finalization in the fourth quarter of 2026, carrying a half-year uncertainty band given the instrument's current consultation status; this estimate should be read as provisional until a dated promulgation notice appears. Until finalization, large processors operate without the specific minimum-necessity and internal-management obligations the draft would introduce, continuing instead under the general Personal Information Protection Law baseline. 1 earlier distinct update(s) Periodic update · new data 2026-09-28 #### Regulator & Framework Enforcement authority in China's data-protection landscape remains distributed across the Cyberspace Administration of China, the Ministry of Public Security and the State Administration for Market Regulation, a standing structural feature rather than a new development this cycle. What is new is the amended Cybersecurity Law, effective 1 January 2026, which is reported to constitute the most substantial amendment to the CSL since its original 2017 adoption. The amendment's most consequential feature for the regulator-and-framework module is its broadening of overseas-conduct enforcement beyond the law's former scope, which had been limited to conduct endangering critical information infrastructure. This is a genuine territorial-scope expansion, not a restatement: overseas conduct that does not touch critical information infrastructure may now fall within the amended law's enforcement reach, a materially broader jurisdictional claim than the pre-amendment framework asserted. This territorial expansion sits within a distributed-authority structure in which no single regulator holds exclusive enforcement power, meaning that the amended CSL's broadened scope will likely be operationalised through coordinated action across the three named bodies rather than through a single regulator's independent enforcement programme. The evidence base for the amendment's content and its territorial-scope implications derives from secondary legal-commentary sources rather than direct retrieval of the primary amended statutory text, a limitation that should be borne in mind when assessing the precision of the scope-expansion claim. #### Outlook Watch for primary-text confirmation of the amended CSL's exact territorial-scope language, which would allow more precise assessment of how far beyond critical-information-infrastructure conduct the new overseas-enforcement reach actually extends. Watch also for the first enforcement action under the amended law against an entity with no critical-information-infrastructure nexus, which would be the clearest practical test of the new scope. 1 further periodic run re-emitted the standing brief unchanged and is not shown. Evidence 5 Sources and claims (5) - Probable[IAPP](https://iapp.org/news/a/top-5-operational-impacts-of-chinas-pipl-part-4-penalties-and-enforcement-mechanisms) — The PIPL confers enforcement authority jointly on multiple governmental departments — CAC, MIIT, the Ministry of Public Security, SAMR and financial regulators, plus local counterparts — with CAC taking a leading and coordinating role rather than acting as a single unified supervisory authority as under GDPR or CPRA.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/china-issues-the-regulations-on-network-data-security-management-what-s-important-to-know) — China's data governance framework rests on three national laws (CSL 2017/amended 2025, DSL 2021, PIPL 2021), implemented at national level via the Regulations on Network Data Security Management, effective 1 January 2025.observed 2026-08-03 - Probable[OneTrust DataGuidance](https://www.dataguidance.com/sites/default/files/gdpr_v_pipl_.pdf) — PIPL is China's first comprehensive data protection legislation and regulates personal information handling activities by personal information handlers and entrusted parties.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/analyzing-chinas-pipl-and-how-it-compares-to-the-eus-gdpr) — PIPL Article 3 extends its territorial scope to the handling of personal information conducted outside China where the purpose is to provide products or services to, or to analyze/assess the behavior of, individuals located in China, or other purposes specified by law.observed 2026-08-03 - Probable[IAPP](https://iapp.org/news/a/analyzing-chinas-pipl-and-how-it-compares-to-the-eus-gdpr) — Offshore personal information handlers subject to PIPL under its extraterritorial provisions must establish a dedicated office or appoint a designated representative in China for personal information protection purposes (Art 53).observed 2026-08-03