China's Tiered PIPL Regime Takes Shape: Small-Processor Simplification Live September 1, Large-Processor Rules Consulted

China's Tiered PIPL Regime Takes Shape: Small-Processor Simplification Live September 1, Large-Processor Rules Consulted

China is building a scale-based regulatory ladder around the PIPL¹, and both ends moved in September 2026 — with direct consequences for how multinational subsidiaries structure data flows out of China.

Small processors (in force September 1, 2026). The Provisions on Simplified Personal Information Protection Measures for Small Personal Information Processors (CAC/MPS Order No. 25, adopted June 26, 2026) give processors handling personal information of fewer than 100,000 individuals a lighter toolkit: notice by simply publishing processing rules, compliance audits every five years on a self-check form, a simplified impact-assessment form, and no-penalty or mitigated-penalty grounds for minor first violations. The trap for multinationals is Article 6: publication-only notice is only available if the data is "neither provided to another processor nor made public" — and a China subsidiary feeding employee records into a global HR system or customer contacts into a group CRM is usually "providing" to another processor, knocking it back to ordinary PIPL notice rules. The cross-border regime "barely changes at all": Article 10's exemptions are the familiar March 2024 list (contract necessity, cross-border HR management, emergencies, statutory duties, and sub-100,000 non-sensitive transfers cumulatively since January 1), with important data excluded.

Recruitment data narrowed (July 24, 2026). The CAC's July 2026 Q&A on data export security management states that sending Chinese job applicants' CVs to an overseas headquarters "that takes no part in the hiring decision" is not necessary — so those CVs should stay in China. Where headquarters does participate, the number of candidates and data fields must be minimized and the transfer must run through the security assessment, standard contract, or certification routes with notice, separate consent, and a PIPIA. Practitioners read this as confirming that candidates (no employment relationship yet) fall outside the cross-border HR-management exemption.

Large processors (draft, consultation closed September 7, 2026). The CAC's draft rules for large personal information processors — roughly, organisations processing the personal information of more than 10 million people, providing important network services, or whose processing significantly affects national security, economic activity, social stability, or public health — would require domestic storage of personal information collected in China and use of China-located data centres meeting specified ownership and policy requirements. Transfers abroad would remain subject to the existing security assessment/standard contract/certification mechanisms, plus a new obligation to assess whether overseas recipients can meet their data protection obligations. The draft also mandates a senior-level personal information protection officer, annual risk assessments, compliance audits at least every two years, published annual protection reports, and an independent supervisory committee mostly composed of external members². As Digital Watch put it, China is "treating major data handlers increasingly like regulated infrastructure institutions" — a tiered model that would bind "data protection, localisation, data centre governance, automated decision-making, and corporate oversight... into a single regulatory framework for organisations operating at population scale."

For compliance teams: check which China entities qualify for Order No. 25 (and which group data flows disqualify them), audit recruitment flows against the July Q&A, and — if any operation approaches the 10-million-person threshold — model the domestic-storage and data-centre-ownership implications of the draft large-processor rules, which would compound the localization pressures documented in China: Nationwide PIPL Special Enforcement Campaign Now Producing Published Precedents — First Fine on Unassessed PI Export (September 2026) and China: Shanghai Expands Data Export Negative List Citywide (April 2026).