In four days, China demonstrated how they move on personal data from two directions at once. The developments are separate, but together they point in one direction: personal data needs to be handled in a lawful manner.
On August 7, the Cyberspace Administration of China published the 50-article draft, Provisions on Personal Information Protection for Large Personal Information Processors (available for public consultation until September 7). The draft considers several conditions together, including processing personal information of ten million or more people, providing important network services involving personal information, operating across multiple business types, and having activities that significantly affect national security, economic operations, social stability or public health and safety.
Those meeting these conditions need to register at the national level via their provincial cyberspace offices and keep the personal data collected and generated in China on domestic servers. One provision is especially worth mentioning: foreign entities and individuals who are found to have infringed on the personal information rights of Chinese citizens, or to have endangered the national security and public interest, may be put on a published list. Once listed, providing them with personal information may be restricted or prohibited.
Four days later, another side of the same coin, protection of personal data, was demonstrated. On August 11, the Ministry of Public Security announced ten typical cases of personal information infringement. In one case, a firm acquired hotel check-in records, vehicle records and travel trajectories via overseas platforms and sold them to lawyers, investigators and information brokers. More than 100,000 records were affected. From 2020 to 2024, police solved over 40,000 such cases.
The two speak to different audiences. For companies with users in China, the instinct will be to check the ten million figure and move on. That would be premature: the draft weighs all its conditions together, so a smaller operator running important network services, or several different businesses that each handle personal data, can still be identified.
In the market of investigations, the cases draw a line that was not always respected: the buyers were lawyers, investigators and brokers. Hotel records, vehicle registrations and movement data taken from the systems that hold them are outside what private parties can lawfully collect.
None of this constrains legitimate work. Ownership structures, litigation and enforcement records, public records, regulatory filings and adverse media are open or lawfully accessible. What enforcement removes is the shortcut, and the firms that depend on it.
Enforcement of this kind raises the floor. It makes method, not only findings, part of what a client is buying.
By Johan Magnusson, Consultant