China is preparing tougher privacy requirements for organizations that handle large volumes of personal information, expanding regulatory scrutiny beyond the country’s biggest Internet platforms as Beijing strengthens oversight of data security and privacy.

The proposed measures would place additional obligations on large personal-information handlers. The move comes as China continues to build a comprehensive regulatory framework governing how companies collect, process, store and transfer personal information.

Broader Regulatory Push

China’s Personal Information Protection Law, which took effect in November 2021, already requires organizations to limit data collection, obtain consent in applicable circumstances and safeguard personal information. Regulators have since introduced additional requirements for organizations handling data at scale.

Under rules that took effect in 2025, companies processing personal information belonging to more than 10 million people must conduct a personal-information protection compliance audit at least once every two years. Organizations handling data on more than 1 million people must appoint a designated personal-information protection official.

China has also been tightening supervision of large online platforms. Draft provisions released in November 2025 proposed identifying large platforms partly by user numbers, including those with at least 50 million registered users or 10 million monthly active users, while also considering the importance and sensitivity of the data they process.

Compliance Pressure Rises

The latest initiative signals that China’s privacy regime is moving towards more differentiated oversight based on the volume of information handled and the potential risks associated with it.

At the same time, regulators have sought to ease compliance burdens for smaller businesses. Rules issued in July 2026 provide simplified privacy obligations for small personal-information processors handling data involving fewer than 100,000 individuals.

China’s cyberspace authorities have separately announced 2026 enforcement campaigns targeting unlawful collection and use of personal information by apps, software-development kits and businesses in sectors including finance, healthcare, education and transport.

The combination of tougher requirements for major data handlers and lighter rules for smaller operators points to a risk-based approach as China seeks to strengthen privacy protection while maintaining control over its rapidly expanding digital economy.

Reference

MLex, “China targets large personal-data handlers with tougher privacy rules,” August 10, 2026. MLex report

Cyberspace Administration of China, Personal Information Protection Policy and Regulation Q&A, April 29, 2026. CAC source

Cyberspace Administration of China, Rules on Simplified Personal Information Protection Measures for Small Processors, July 24, 2026. CAC source

Cyberspace Administration of China, 2026 Personal Information Protection Special Actions, April 2, 2026. CAC source