每周数据法律资讯 Data Law Weekly（20260803—20260809）

1.国家网信办就《大型个人信息处理者个人信息保护规定（征求意见稿）》公开征求意见

8月7日，国家互联网信息办公室发布《大型个人信息处理者个人信息保护规定（征求意见稿）》，向社会公开征求意见，意见反馈截止至2026年9月7日。征求意见稿明确处理1000万人以上自然人个人信息等大型个人信息处理者认定标准，建立企业申报、多部门联合认定及动态调整机制；围绕个人信息处理规则、个人信息境内存储、数据中心管理、个人信息出境、自动化决策、个人信息转移等提出具体要求，明确要求设立个人信息保护监督委员会、发布个人信息保护社会责任报告、开展个人信息保护合规审计、开展个人信息保护影响评估并备案等制度，进一步完善大型个人信息处理者个人信息保护制度。

【参见：

https://mp.weixin.qq.com/s/BeNitCJ468LFRu6D0rE-7Q】

【合规提示：大型个人信息处理者的“新义务”主要包括：

1.个人信息保护负责人姓名公示：个人信息处理规则中需公示个人信息保护负责人姓名。

2.撤回同意清单化：需以结构化清单形式列明个人已同意大型个人信息处理者处理的个人信息种类，以及个人信息的处理目的、处理方式，便于个人选择撤回同意。

3.数据本地化：应当将在中华人民共和国境内运营中收集和产生的个人信息存储在境内。

4.数据中心特定化：存储个人信息的数据中心，应当满足特定要求，包括（1）设立在中华人民共和国境内；（2）数据中心管理机构的法定代表人或者实际控制人具有中华人民共和国国籍；（3）符合国家有关政策标准要求。

5.个人信息保护社会责任报告：每年编制并于上半年发布上一年度个人信息保护社会责任报告。

6.PIA备案：上线涉及自动化决策、敏感个人信息处理等可能对个人权益有重大影响的产品、服务或者功能，应当事前开展个人信息保护影响评估，并在评估完成后的15个工作日内通过所在地省级网信部门将影响评估报告报国家网信部门备案。

7.未成年人识别：需通过国家网络身份认证公共服务等方式识别未成年人，每年开展未成年人个人信息保护合规审计。

8.信息报送：大型个人信息处理者应当自被认定之日起30个工作日内向所在地设区的市级网信部门报送有关信息：（1）个人信息保护负责人基本信息；（2）保障个人信息保护负责人履职的措施；（3）存储个人信息的数据中心基本信息。

9.个人信息保护合规审计：至少每两年通过所在地省级网信部门向国家网信部门报送个人信息保护合规审计报告。

10. 个人信息保护监督委员会：大型个人信息处理者应当自被认定之日起6个月内成立主要由外部成员组成的个人信息保护监督委员会，并通过所在地省级网信部门向国家网信部门报送监督委员会成立情况、工作规则、成员名单等基本信息。且每年第一季度通过所在地省级网信部门向国家网信部门报送监督委员会上一年度履职情况。】

CAC Seeks Public Comments on “the Draft Regulations on Personal Information Protection for Large Personal Information Processors”

On August 7, the CAC released the Draft Regulations on Personal Information Protection for Large Personal Information Processors for public comments, with the feedback period ending on September 7, 2026. The Draft Regulations clarify the criteria for identifying large personal information processors, including those processing personal information of more than 10 million individuals, and establish mechanisms for enterprise application, multi-department joint recognition, and dynamic adjustment. They set out specific requirements regarding personal information processing rules, domestic storage of personal information, data center management, cross-border transfer of personal information, automated decision-making, and personal information transfer. The Draft Regulations also require large personal information processors to establish personal information protection supervisory committees, publish personal information protection social responsibility reports, conduct personal information protection compliance audits, and complete personal information protection impact assessments and filings, further improving the personal information protection framework for large personal information processors.

[Reference:

https://mp.weixin.qq.com/s/BeNitCJ468LFRu6D0rE-7Q]

[Compliance Note: The “new obligations” for large personal information processors primarily include:

1.Public Disclosure of the Name of the Personal Information Protection Officer: The name of the personal information protection officer must be publicly disclosed in the personal information processing rules.

2.Listing of Consent Withdrawal Options: The types of personal information to which an individual has consented for processing by a large personal information processor, as well as the purposes and methods of processing, must be listed in a structured format to facilitate the individual’s choice to withdraw consent.

3.Data Localization: Personal information collected and generated during operations within the territory of the People’s Republic of China must be stored within the country.

4.Data Center Specifications: Data centers storing personal information must meet specific requirements, including (1) being established within the territory of the People’s Republic of China; (2) the legal representative or actual controller of the data center management entity holding the nationality of the People’s Republic of China; and (3) complying with relevant national policy and standard requirements.

5.Personal Information Protection Social Responsibility Report: A personal information protection social responsibility report for the previous year must be prepared annually and published in the first half of the year.

6.PIA Filing: Prior to launching products, services, or features that involve automated decision-making, the processing of sensitive personal information, or other activities that may have a significant impact on individual rights and interests, a Personal Information Protection Impact Assessment (PIA) must be conducted. Within 15 working days after the assessment is completed, the impact assessment report must be submitted to the National Cyberspace Administration for filing through the provincial-level cyberspace administration department where the entity is located.

7.Identification of Minors: Minors must be identified through means such as the National Online Identity Authentication Public Service, and an annual compliance audit on the protection of minors’ personal information must be conducted.

8.Information Submission: Large personal information processors shall, within 30 working days from the date of designation, submit the following information to the municipal-level cyberspace administration department where they are located: (1) basic information regarding the personal information protection officer; (2) measures to ensure the personal information protection officer can perform their duties; (3) basic information regarding the data centers where personal information is stored.

9.Personal Information Protection Compliance Audit: At least once every two years, a personal information protection compliance audit report shall be submitted to the National Cyberspace Administration through the provincial-level cyberspace administration department where the entity is located.

10.Personal Information Protection Oversight Committee: Large personal information processors shall, within 6 months from the date of designation, establish a Personal Information Protection Oversight Committee composed primarily of external members, and submit basic information—including details on the committee’s establishment, operating rules, and list of members—to the National Cyberspace Administration through the provincial-level cyberspace administration department where they are located. Furthermore, they shall submit a report on the committee’s performance during the previous year to the National Cyberspace Administration through the provincial-level cyberspace administration department where they are located during the first quarter of each year.]

2.公安部发布《公安机关网络空间安全监督检查办法》

8月6日，公安部发布《公安机关网络空间安全监督检查办法》（公安部令第176号），将于2026年10月1日起施行，同时废止《公安机关互联网安全监督检查规定》（公安部令第151号）。《办法》明确公安机关可依法对网络运营者、数据处理者、个人信息处理者等主体开展网络空间安全监督检查，规范线上巡查、远程检测、现场检查等监督检查方式，重点检查网络安全等级保护、关键信息基础设施安全保护、数据安全、个人信息保护、算法安全责任落实等法定义务履行情况，并强调加强与网信部门、行业主管部门的协同配合，避免重复检查、交叉检查，进一步规范网络空间安全监督检查工作。

【参见：

https://mp.weixin.qq.com/s/UsluP36syt_CPlucDq-34g】

MPS Issues “the Measures for Cybersecurity Supervision and Inspection by Public Security Organs”

On August 6, the MPS issued “the Measures for Cybersecurity Supervision and Inspection by Public Security Organs” (MPS Order No. 176), which will take effect on October 1, 2026, and repeal “the Regulations on Internet Security Supervision and Inspection by Public Security Organs” (MPS Order No. 151). The Measures clarify that public security organs may conduct cybersecurity supervision and inspections of entities including network operators, data processors, and personal information processors in accordance with the law. The Measures regulate inspection methods such as online inspections, remote detection, and on-site inspections, focusing on compliance with legal obligations relating to cybersecurity level protection, critical information infrastructure security protection, data security, personal information protection, and algorithm security responsibilities. The Measures further emphasize coordination with cyberspace administration authorities and industry regulators to avoid duplicate or overlapping inspections and further standardize cybersecurity supervision and inspection activities.

[Reference:

https://mp.weixin.qq.com/s/UsluP36syt_CPlucDq-34g]

3.网络安全审查办公室对派拓公司在华销售产品启动网络安全审查

8月6日，网络安全审查办公室发布公告，依据《中华人民共和国国家安全法》《中华人民共和国网络安全法》及《网络安全审查办法》，对派拓公司（Palo Alto Networks）在华销售的产品实施网络安全审查。此次审查旨在保障关键信息基础设施安全稳定运行，防范网络安全风险隐患，维护国家安全。

【参见：

https://mp.weixin.qq.com/s/MevpAlauJosPJZ1gqeTujA】
 

Cybersecurity Review Office Initiates Cybersecurity Review of Palo Alto Networks Products Sold in China

On August 6, the Cybersecurity Review Office issued an announcement stating that, pursuant to “the National Security Law of the People’s Republic of China”, “the Cybersecurity Law of the People’s Republic of China”, and “the Cybersecurity Review Measures”, a cybersecurity review has been initiated for products sold in China by Palo Alto Networks. The review aims to ensure the secure and stable operation of critical information infrastructure, prevent cybersecurity risks, and safeguard national security.

[Reference:

https://mp.weixin.qq.com/s/MevpAlauJosPJZ1gqeTujA]

4.《智能网联汽车-自动驾驶系统安全要求》强制性国家标准正式发布

8月4日，工业和信息化部发布《智能网联汽车自动驾驶系统安全要求》（GB 44721—2026）强制性国家标准，拟于2027年7月1日起正式实施。该标准适用于搭载L3级、L4级自动驾驶系统的M类和N类车辆（不适用于自动泊车系统），从企业全生命周期安全保障、自动驾驶系统动态驾驶任务执行、人机交互与用户告知、检验检测等方面提出安全要求，明确车辆制造商应建立覆盖产品设计开发、生产制造及部署后全过程的安全保障机制，并开展仿真、场地及道路试验等研发验证。

【参见：

https://www.miit.gov.cn/jgsj/zbys/qcgy/art/2026/art_a1d2072374884287b67048a77560014e.html】
 

Mandatory National Standard “Intelligent Connected Vehicle-Safety Requirements for Automated Driving Systems” Officially Issued

On August 4, the MIIT issued the mandatory national standard “Intelligent Connected Vehicle-Safety Requirements for Automated Driving Systems” (GB 44721—2026), which is scheduled to take effect on July 1, 2027. The standard applies to M and N category vehicles equipped with L3 and L4 automated driving systems and does not apply to automated parking systems. It sets out safety requirements covering enterprise lifecycle safety assurance, dynamic driving task execution by automated driving systems, human-machine interaction and user notification, and inspection and testing. The standard requires vehicle manufacturers to establish safety assurance mechanisms covering the entire lifecycle from product design and development, production and manufacturing, to post-deployment operations, and to conduct simulation, test track, and road testing during research and validation.

[Reference:

https://www.miit.gov.cn/jgsj/zbys/qcgy/art/2026/art_a1d2072374884287b67048a77560014e.html]

5.北京落地全国首个银行业数据出境负面清单备案

近日，韩国农协银行北京分行完成全国首个银行业数据出境负面清单备案项目，依托北京市“两区”2025版数据出境负面清单（“1+9”制度架构），实现数据出境管理模式由标准合同备案转向负面清单框架下的安全有序流动。北京市“两区”数据出境负面清单在原有基础上新增银行业、自动驾驶（智能网联汽车）、医疗器械、贸易物流等领域，覆盖67个业务场景、612个数据字段。此次项目落地标志着北京数据跨境制度创新在银行业领域实现应用，也为多行业推广负面清单管理模式积累了实践经验。

【参见：

https://mp.weixin.qq.com/s/RvSnYfSTrQ4FWnwJTKjlLQ】
 

Beijing Implements China’s First Negative List Filing for Banking Data Export

Recently, the Beijing Branch of Nonghyup Bank completed China’s first negative list filing project for banking data export. Relying on the 2025 version of Beijing’s “Two Zones” data export negative list framework (“1+9” system structure), the project shifted the data export management model from standard contract filing to secure and orderly data flows under the negative list framework. Beijing’s data export negative list under the “Two Zones” initiative added four new sectors, including banking, automated driving (intelligent connected vehicles), medical devices, and trade logistics, covering 67 business scenarios and 612 data fields. The implementation of this project marks the application of Beijing’s data cross-border governance innovation in the banking sector and provides practical experience for promoting the negative list management model across multiple industries.

[Reference:

https://mp.weixin.qq.com/s/RvSnYfSTrQ4FWnwJTKjlLQ]

1.欧盟委员会开始执行《人工智能法案》规则及透明度要求

8月2日起，欧盟《人工智能法案》的进一步规则正式适用，欧盟委员会人工智能办公室及成员国主管机关开始行使相应监督和执法权限。其中，《人工智能法案》第50条透明度义务同步适用，要求相关AI系统提供者和部署者就用户与AI系统交互、AI生成或操纵内容、深度伪造以及情绪识别和生物识别分类等场景履行透明度义务。欧盟委员会同时开始对通用人工智能模型提供者相关义务开展执法。

【参见：

https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august?utm】

EU Commission Starts Enforcing AI Act Rules and Transparency Requirements

From August 2, further provisions of the EU AI Act became applicable, with the European AI Office and national competent authorities beginning to exercise their supervisory and enforcement powers. The transparency obligations under Article 50 also apply from this date, requiring relevant AI providers and deployers to ensure transparency in areas including human-AI interaction, AI-generated or manipulated content, deepfakes, emotion recognition and biometric categorisation. The Commission also begins enforcing obligations applicable to providers of general-purpose AI models.

[Reference:

https://digital-strategy.ec.europa.eu/en/news/commission-starts-enforcing-ai-act-rules-and-new-transparency-requirements-2-august?utm]

2.《加州人工智能透明法案》正式实施

8月2日，经加州议会第853号法案（AB 853）修订的《加州人工智能透明法案》（California AI Transparency Act）正式实施。该法案主要适用于在加州公开提供、月访问量或用户数超过100万的生成式AI系统提供商，要求其免费提供AI生成内容检测工具，并对AI生成或修改的图像、视频及音频等内容提供显著标识选项及嵌入可检测的来源信息。违反相关要求的，可能面临每次违法5,000美元的民事罚款。AB 853同时将部分义务扩展至大型在线平台、生成式AI系统托管平台及特定内容采集设备制造商，相关要求将自2027年或2028年起分阶段实施。

【点击查阅法案原文：

https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853&utm】
 

California AI Transparency Act Takes Effect

On August 2, the California AI Transparency Act, as amended by Assembly Bill 853 (AB 853), became operative. The Act primarily applies to providers of publicly accessible generative AI systems with more than one million monthly visitors or users in California, requiring them to provide a free AI detection tool and to offer conspicuous disclosures and embed detectable provenance information in AI-generated or altered image, video and audio content. Violations may result in civil penalties of USD 5,000 per violation. AB 853 also extends certain requirements to large online platforms, GenAI hosting platforms and certain capture device manufacturers, with those obligations taking effect in phases from 2027 and 2028.

[Click to view the full text of the bill:

https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB853&utm]