A personal information processor (or “data controller” in GDPR terminology) operating in mainland China that handles the personal information of fewer than 100,000 individuals qualifies as a “small-scale personal information processor” under the rules.
This data volume threshold is notably distinct from the employee headcount and financial size criteria (turnover and total assets) used to define “small mid-cap enterprises” (SMCs) in the proposed EU Digital Omnibus.
To address questions raised by businesses during the consultation, the CAC has issued an official Q&A clarifying that headcount is measured at the point of assessment based on the number of natural persons whose personal information is being processed; personal information that has already been deleted is excluded from the calculation.
Businesses looking to rely on the simplified regime should therefore monitor their processing volumes on an ongoing basis and keep records supporting their assessment. This will be particularly important for multinational groups whose China-facing operations handle customer, employee and other personal information across multiple systems or business lines.
It is also worth noting that the rules apply on a territorial basis: they are available only to processors located within mainland China. Offshore entities caught by the extraterritorial reach of the PIPL, regardless of the volume of their processing activities, do not appear to benefit from the simplified regime.
