国家网信办、公安部联合公布《小型个人信息处理者个人信息保护简化措施规定》，该规定将自2026年9月1日起施行[1]。规定面向处理不满10万人个人信息的小型信息处理者，在个人信息处理规则、告知义务、个人同意、权利申请、信息删除等多个方面制定了简化措施，旨在降低其合规成本的同时维护个人信息安全[1]。
规定提出多项便利措施以减轻小型处理者负担[1]。小型个人信息处理者在向境外提供个人信息时免予申报数据出境安全评估[1]；通过个人信息保护认证的小型个人信息处理者在认证有效期内可免予开展合规审计[1]。此外，对违反规定的小型个人信息处理者，相关部门可不予处罚、从轻或减轻处罚[1]。
The Cyberspace Administration of China and the Ministry of Public Security have jointly issued the "Simplified Personal Information Protection Measures for Small Personal Information Handlers," which will take effect on September 1, 2026.[1]
The regulation applies to small personal information handlers processing personal information of fewer than 100,000 individuals.[1] It establishes simplified measures across multiple areas including personal information processing rules, notification obligations, personal consent requirements, rights application procedures, and information deletion protocols, all aimed at reducing compliance burdens while maintaining personal information security.[1]
Under the new framework, small personal information handlers are exempt from submitting data outbound security assessments when transferring personal information abroad.[1] Additionally, those who have obtained personal information protection certification may forgo compliance audits during the certification's validity period.[1] The regulation also provides enforcement flexibility, allowing authorities to refrain from imposing penalties, or to impose reduced or lighter penalties, against small handlers found in violation of the rules.[1]