China’s cyberspace regulator has launched a public consultation on draft rules that would tighten personal information governance for large online platforms. These rules reinforce protections for sensitive data covered by the country’s Personal Information Protection Law, including biometrics. The Cyberspace Administration of China and the Ministry of Public Security issued a joint notice on November 22, 2025, inviting comments on the provisions through December 22, 2025. The draft defines large online platforms as providers with more than fifty million registered users or ten million monthly active users, or those that offer important online services where a data breach could materially affect national security or public welfare. Regulators plan to publish and update a catalogue of platforms that fall under these rules.
Governance requirements would be tightened considerably under the new proposal. Covered platforms would need to appoint a personal information protection officer who is a Chinese national without foreign permanent residency. They would also need to establish a dedicated personal information protection department responsible for internal policies, risk monitoring, incident response, and complaint handling. Details of the officer and department would have to be filed with the regulator. The draft also calls for local data storage in PRC-based data centers with responsible personnel who are Chinese nationals, and it sets out more prescriptive conditions for using third-party data centers and transferring personal information to other handlers.
These rules sit on top of the existing Personal Information Protection Law, which already treats biometric identifiers and location data as sensitive personal information subject to stricter consent and security obligations. They also follow earlier measures that require regular privacy audits for very large data handlers and draft regulations on facial recognition that seek to limit mandatory use of biometric identification in everyday scenarios.
For large platforms that rely heavily on biometric logins or behavioral analytics for authentication and fraud prevention, the draft provisions signal further scrutiny of data localization, internal governance, and cross-platform transfers of sensitive personal data. International vendors serving Chinese platforms will need to monitor the consultation closely, particularly around any final rules that tighten restrictions on cross-border transfers or outsourcing of biometric processing. The requirement for specific personnel nationalities and local storage infrastructure creates a steeper compliance barrier for foreign operators effectively functioning within the domestic market.
Sources: CMS LawNow, Hawksford, DLA Piper – China country page, Reuters via ThePrint
—
By Cass Kennedy
