China's Cyberspace Administration published draft rules on Aug. 7 creating a new regulatory tier called "large-scale personal information handler." The threshold is either processing data on 10 million people or more, or having data processing that significantly affects national security or public safety regardless of the raw number, a dual test that leaves the agency real discretion even below the headline figure[1][2]. Companies that land in the category face enhanced governance obligations and a formal application process directly with the CAC, on top of the baseline requirements every company already meets under China's existing Personal Information Protection Law.

Public comment on the draft closed Sept. 7, and financial services, healthcare, and e-commerce firms are expected to fall squarely inside the new category once it's finalized. That's not a surprise. Those are exactly the industries whose user bases at China's scale cross the 10-million threshold almost automatically[1][3].

I think the structural move here is the more interesting part than the specific threshold. Creating a distinct tier for "large-scale" handlers, on top of a general privacy law, mirrors a pattern regulators elsewhere keep reaching for. The EU's GDPR does something similar for high-risk processing, and most debates over regulating dominant platforms eventually land on the same idea: rules that scale with a company's reach, instead of one flat rule applied identically to a ten-person startup and a national platform.

Once China's version is finalized, I want to see whether it ends up more or less demanding than the baseline PIPL rules already on the books. A new tier only matters if it actually asks more of the companies inside it[2][3].