China Issues Draft Provisions on the Simplified Measures for Small-Scale Personal Information Processors
On 3 April 2026, the Cyberspace Administration of China (“CAC“) released the Provisions on the Simplified Measures for Personal Information Protection by Small-scale Personal Information Processors (Draft for Comments) (小型个人信息处理者个人信息保护简化措施规定(征求意见稿), or “Draft Provisions“) for public consultation by 3 May 2026. The Draft Provisions significantly streamline compliance processes and reduce compliance costs for qualified small-scale personal information processors.
- Definition of Small-Scale Processors
The Draft Provisions apply to personal information processors within China that process the personal information of fewer than 100,000 individuals (“Small-Scale Processors“). The specific methodology for counting towards the “100,000 individuals” threshold has not yet been clarified.
- Key Simplifications
- Compliance ride-along: The Draft Provisions introduce a “compliance ride-along” mechanism, allowing Small-Scale Processors to rely on the rules of their host platforms or management entities in lieu of formulating their own personal information processing rules where certain conditions are met.
- Consent: Where a Small-Scale Processor has published its personal information processing rules and provided adequate notice, an individual’s voluntary submission of personal information may be construed as consent through affirmative action to the processing of such information.
- Personal Information Protection Impact Assessment (“PIA”): The Draft Provisions expressly permit Small-Scale Processors to conduct PIAs in a simplified manner using the template form annexed to the Draft Provisions, with only the assessment conclusions required to be recorded. Where an eligible Small-Scale Processor operates through an online platform and the platform has already conducted a PIA, it is no longer required to conduct a separate assessment.
- Penalty
The Draft Provisions introduce a more lenient penalty framework for Small-Scale Processors.
- Exemption from penalties: A Small-Scale Processor shall not be penalised where: (i) the violation is minor and promptly rectified with no harmful consequences; or (ii) it is a first-time violation with minor harmful consequences that are promptly rectified. Where no penalty is imposed, the department responsible for personal data protection shall, as appropriate, take administrative supervisory measures such as conducting interviews or issuing reminder letters.
- Mitigated or reduced penalties: Where certain conditions are met, penalties shall be mitigated or reduced for a Small-Scale Processor.
Although the Draft Provisions remain a draft for public comment, it signals a clear regulatory trend towards compliance simplification for Small-Scale Processors.
China Issues (1) Provisions on the Security of Industrial and Supply Chains, and (2) Regulation on Anti-Foreign Improper Extraterritorial Jurisdiction
In April 2026, the People’s Republic of China (“PRC“) State Council successively issued (i) the Provisions on the Security of Industrial and Supply Chains (国务院关于产业链供应链安全的规定, or “Supply Chains Provisions“), adopted at the 81st Executive Meeting of the PRC State Council on 13 March 2026, and (ii) the Regulation on Anti-Foreign Improper Extraterritorial Jurisdiction (反外国不当域外管辖条例, or “Anti–Improper Jurisdiction Regulation“), adopted at the 82nd Executive Meeting of the PRC State Council on 27 March 2026, both of which came into effect on their respective dates of issuance.
The Supply Chains Provisions are oriented towards safeguarding the security and stability of critical industries, encompassing a range of mechanisms, while the Anti-Improper Jurisdiction Regulation provides institutional support for the Chinese government to adopt measures against foreign countries implementing improper extraterritorial jurisdiction measures that harm China’s sovereignty, security, development interests, and the legitimate rights of PRC citizens and organisations.
Some key highlights of the two regulations are set out below.
Supply Chains Provisions
- “Key Sector List” regime and associated mechanisms (Articles 7-11)
Article 7 provides that the relevant departments of the PRC State Council shall formulate a “Key Sector List”. Pursuant to Articles 8 through 11, supply chains falling within the key sectors on the list are subject to information-sharing arrangements, monitoring and early warning mechanisms, risk prevention mechanisms, and emergency response mechanisms.
- Supply chain security investigations and countermeasures (Articles 14-15)
Articles 14 and 15 empower the relevant departments of the PRC State Council to investigate supply chain security threats and impose countermeasures in response.
Article 14 stipulates that where a foreign state, region, or international organisation adopts discriminatory prohibitions, restrictions, or similar measures against China’s supply chains in violation of international law, the relevant departments of the PRC State Council may conduct supply chain investigation and impose countermeasures such as restrictions on the import and export of goods, technology, or services, as well as levying special charges.
Article 15 stipulates that where a foreign organisation or individual disrupts normal commercial dealings with Chinese entities in violation of normal market transaction principles, the relevant departments of the PRC State Council may conduct supply chain investigation and impose measures including investment bans, transaction restrictions, entry prohibitions, and the revocation of residency or work qualifications.
Anti-Improper Jurisdiction Regulation
- Malicious entity list (Article 8)
Article 8 provides that where foreign organisations and individuals implement or participate in the implementation of improper extraterritorial jurisdiction measures, the relevant departments of the PRC State Council may include them in the malicious entity list and adopt countermeasures, including refusing visas, deportation, sealing up, retaining or freezing of their assets and properties in China, prohibiting or restricting the provision of data, related transactions and cooperation, and restricting import and export activities and investments in China.
- Enforcement prohibition order (Article 13)
Article 13 provides that where organisations or individuals implement or assist in implementing improper extraterritorial jurisdiction measures, the legal affairs department of the PRC State Council may issue a blocking order prohibiting the implementation of such measures.
Taken together, the two new regulations are not mere policy declarations. They incorporate a range of protective mechanisms, including countermeasures, into the existing institutional framework to make it more complete and coherent. Organisations and individuals should therefore monitor any identification notice, blocking order, or related list announcement that China may issue pursuant to these two new regulations and relevant previously-issued regulations.
Laos and China Set Direction for Digital, Green and Connectivity Development
Laos and China have outlined their roadmap for deepening bilateral cooperation, with a focus on digital innovation, green development and stronger regional connectivity. This was highlighted at the “China in the New Spring” symposium held in Vientiane, according to a media report. The event signaled a new phase in efforts to build a Laos-China community with a shared future.
The meeting adopted several key documents, including China’s 15th five‑year socio‑economic development plan, with China noting that its high‑quality development strategy has created new opportunities globally. China also expressed its intention to enhance its role in the international media landscape by leveraging its extensive global communications network, which operates in 85 foreign languages and spans 192 overseas offices. This would also deepen the integration of culture and science and technology, make it possible to conduct studies in areas such as 5G and 6G and high-definition signals, as well as artificial intelligence, while promoting cultural exchanges aimed at fostering closer people‑to‑people connections.
China further indicated that it would encourage increased investment by Chinese businesses in Laos, particularly in the digital economy and clean energy sectors. Enhancing regional connectivity was also discussed, with reference to major cooperation projects such as the Laos-China railway and the expressway, which have supported Laos’ development.
Both countries reaffirmed their commitment to development that is people-centred, open, and mutually beneficial.
China Promulgates New Provisions on the Protection of Trade Secrets
On 24 February 2026, the People’s Republic of China (“PRC“) State Administration for Market Regulation (“SAMR“) promulgated the Provisions on the Protection of Trade Secrets (商业秘密保护规定, SAMR Order No. 126, or “New Provisions“), which will come into force on 1 June 2026. Grounded in the PRC Anti-Unfair Competition Law, the New Provisions comprehensively replace the Several Provisions on Prohibiting Trade Secret Infringement (关于禁止侵犯商业秘密行为的若干规定, or “Former Provisions“) issued by the former State Administration for Industry and Commerce in 1995. Where the Former Provisions focused primarily on post-hoc enforcement through broadly worded provisions, the New Provisions establish a full-cycle protection framework covering prevention, in-process response, and post-infringement penalties.
The most significant amendment introduced by the New Provisions is the revised criteria for a trade secret. The New Provisions set out the three constituent elements of a trade secret: (i) not generally known to the public; (ii) possessing commercial value; and (iii) subject to reasonable confidentiality measures.
Based on the New Provisions, “commercial value” refers to commercial information possessing actual or potential value that can bring commercial benefits or competitive advantages to the rights holder, such as an increase in assets, growth in operating revenue or profits, an increase in the number of users, a decrease in costs and expenses, a shortening of research and development time, an increase in business opportunities, or an enhancement of commercial reputation or product reputation.
Based on the Former Provisions, trade secrets must have “practical utility“. However, the New Provisions recognise that “interim research outcomes” or “failed experimental data, technical solutions, etc.” generated in the course of business operations possess commercial value and fall within the scope of trade secret protection.
It is evident that the New Regulations were promulgated to address the need for the protection of trade secrets in the digital economy era, completely abandoning the notion that trade secrets must have “practical utility”. So long as commercial information can confer commercial benefits or a competitive advantage on the rights holder, it may fall within the scope of trade secret protection.
The New Provisions also clarify what constitutes improper acquisition – namely, theft, bribery, fraud, coercion, and electronic intrusion – and tighten the rules on aiding and abetting. They also provide for third-party liability across the full chain of infringement. Administrative enforcement is further bolstered through standardised procedures and clearer jurisdictional rules. Technical trade secret cases, for example, are generally to be handled at the municipal level or above.
The New Provisions mark a significant upgrade to China’s administrative trade secret protection regime. Businesses operating in China or dealing with China-related entities should take this opportunity to review and strengthen their confidentiality management systems.
Please note that whilst the information in this Update is correct to the best of our knowledge and belief at the time of writing, it is only intended to provide a general guide to the subject matter and should not be treated as a substitute for specific professional advice
