China’s top internet regulator has proposed stringent new personnel requirements for companies handling massive amounts of user data, imposing loyalty-filtering tests that exceed even the country’s own regulations for state secrets workers. The Cyberspace Administration of China (CAC) published draft rules on Monday requiring every “large-scale personal-information processor” to appoint a data compliance officer who holds Chinese nationality and has never held permanent residency or a long-term residence permit in any foreign country.
The draft regulation, which is open for public comment through September 7, 2026, represents a significant escalation in Beijing’s efforts to secure its domestic data infrastructure. It extends beyond previous proposals aimed solely at “large online platforms,” expanding its reach to any organization whose data holdings could damage national security, the economy, or public welfare if compromised.
The practical effect of this expansion is profound. The definition turns primarily on scale: entities with more than 50 million registered users or 10 million monthly active users are candidates for formal designation. This means financial institutions, healthcare providers, logistics companies, and enterprise software firms operating in China at any meaningful scale now fall within the same regulatory tier as tech giants like Alibaba and Tencent. Covered entities will be formally identified by the CAC working jointly with the Ministry of Public Security, and the resulting list will be made public.
The Citizenship and Residency Filter
The most structurally demanding provision in the draft is the requirement to appoint a personal information protection officer (PIPO) from within the company’s senior management. This officer must simultaneously meet four strict conditions: Chinese nationality; no permanent residency or long-term residence permit in any foreign country; professional knowledge of personal information protection; and more than five years of relevant work experience.
Legal analysts note that the citizenship-plus-no-foreign-residency combination is exceptional within China’s legal framework. A recent revision to the Regulations on the Implementation of the State Secrets Law which governs individuals working with classified government information considered and ultimately rejected a proposal to include a no-foreign-residency requirement, settling instead for citizenship alone. The CAC draft thus imposes on corporate data officers a loyalty test that the state secrets apparatus deemed too restrictive for its own personnel.
The mandated officer carries substantial authority within the organization. The draft gives the PIPO veto power over data-processing decisions and the explicit ability to report directly to regulators if significant legal violations are discovered. This effectively embeds a state-accessible oversight actor inside covered companies, armed with blocking authority over ordinary business operations. The PIPO is also responsible for drafting internal data protection systems, overseeing the handling of minors’ data, managing compliance audits, and publishing an annual protection report.
Data Center Personnel Requirements
The nationality filter extends beyond the corporate boardroom and into the physical infrastructure of the internet. The draft requires that all personal information collected or generated in China be stored in data centers whose “primary responsible person” is also a Chinese national without permanent overseas residency or a long-term foreign residence permit.
This provision adds a human-layer filter on top of China’s already-demanding data localization framework. The Cybersecurity Law and the Personal Information Protection Law (PIPL) already mandate that data collected in China must remain onshore. The new draft dictates that it is no longer sufficient for servers to simply be located in China; the individual responsible for those servers must meet the same strict residency conditions as the corporate data officer.
For companies utilizing third-party data centers rather than proprietary facilities, the draft requires detailed contracts and regulatory filings, and obligates the data center operator to report security vulnerabilities promptly to both the covered entity and regulators. Multinational companies that rely on global cloud infrastructure or centralized data architectures will likely need to restructure their Chinese user data pipelines to ensure they flow exclusively through centers that meet both the physical and personnel requirements.
Implications for Multinational Corporations
For multinational companies operating in China, the challenge presented by the draft is both practical and immediate. Identifying a senior Chinese national without foreign residency who possesses the requisite professional qualifications, management standing, and regulatory filing capability to fill the PIPO role is a complex human-capital problem. It represents a fundamental shift in governance requirements that has no equivalent in Western frameworks like the European Union’s General Data Protection Regulation (GDPR).
The legal framework’s reach is unambiguous. China’s National Intelligence Law, Cybersecurity Law, and PIPL apply to any entity processing the personal information of individuals in China, regardless of where the entity is headquartered or where its servers are physically located outside of China. These obligations apply independently of a company’s stated privacy policy or Western incorporation address.
The enforcement environment is already tightening. In September 2025, Chinese authorities penalized Dior (Shanghai) in the first formal enforcement action under the PIPL against a foreign company for cross-border data transfer violations, signaling a willingness to pursue multinationals for compliance failures. As the September 7 comment deadline approaches, companies with significant China operations face an urgent need to audit their data architectures and personnel structures to prepare for a radically more restrictive regulatory environment.