On 22 Nov 2025, China issued draft regulations imposing enhanced privacy and security obligations on large online platforms.
Who Counts as a “Large Platform”?
• At least 50M registered users, or
• At least 10M MAU, or
• Platforms providing important services / handling sensitive data that could impact national security or public welfare.
Key Obligations
Mandatory Senior PIP Officer
• Must hold Chinese nationality and no permanent overseas residency.
• Has veto power over personal-data processing decisions.
• Oversees compliance, security, and minor protection.
Strong Internal Governance
• Internal rules & operating procedures
• Risk monitoring & DPIAs
• Compliance audits
• Security-incident response & emergency drills
• Staff training
• User-rights handling mechanisms
Expanded Individual Rights
Platforms must provide easy ways for users to:
• Access, copy, correct, and delete data
• Limit processing
• Withdraw consent
• Cancel accounts
Secure Data Transfer & Export
• Support data portability in standardized formats
• Ensure encryption and security measures
• Normally respond within 30 working days
China is elevating privacy standards for platforms with significant scale or societal impact, pushing them toward stronger governance, transparency, and user-rights protection.
S8FE.AI helps platforms and service providers build adaptive, multi-regulation data governance, strengthening compliance readiness under China’s evolving privacy rules.