China Cyberspace Security Association Issues Agent Personal Information Protection Initiative
On September 15, 2026, at the Personal Information Protection Forum of National Cybersecurity Awareness Week in Jinan, Shandong, Wang Yun of the China Cyberspace Security Association released the Agent Personal Information Protection Initiative. The initiative asks agent-related industries to meet personal information protection laws and keep agent development secure, compliant, and controllable.
On September 15, 2026, the Personal Information Protection Forum of the 2026 National Cybersecurity Awareness Week was held in Jinan, Shandong. The forum used the theme "Safeguard Personal Information Security, Build a Long-Term Personal Information Protection Mechanism." It set out to form a personal information protection governance structure that includes government regulation, corporate responsibility, social organization coordination, and public participation. About 200 people attended from central and local competent authorities, professional institutions, universities, and internet companies.
Wang Yun, vice chair of the China Cyberspace Security Association and director of its Personal Information Protection Professional Committee, released the Agent Personal Information Protection Initiative at the forum. The association called on industries related to intelligent agents to strengthen personal information protection, implement personal information protection laws and regulations, and promote secure, compliant, and controllable development of agents.
Context for the Initiative
In recent years, large language models and intelligent agents have developed rapidly and have played a positive role in raising efficiency and promoting industrial upgrading. At the same time, if matching personal information security and compliance measures are absent, agents may create risks in memory storage, tool invocation, cross-device collaboration, external access, and automated decision-making. The association listed excessive collection, unauthorized invocation, provision of personal information without authorization, and personal information leakage among those risks. To implement legal requirements, promote secure, compliant, and controllable agent development, and protect personal information rights and interests, the China Cyberspace Security Association issued the following initiative to the industry.
Lawful Processing and Compliance Basis
Personal information protection requirements should be embedded in agent design, training, deployment, invocation, operations, and exit. Processing purpose, processing methods, retention periods, and responsibility boundaries should be made clear, so that the full process has a legal basis, steps can be traced, responsibility can be assigned, and risks can be controlled.
Necessity Principle and Collection Boundaries
Organizations should fully assess the necessity of personal information collection for each agent function. Collection scope, frequency, and duration should be limited to what is required to provide the function. When an agent invokes tools or accesses external services during task execution, the types, quantity, and frequency of personal information collected should be strictly limited. Personal information obtained through tool invocation or communication among agents should receive the same protection standard as personal information collected directly by the agent.
Transparency and Informed Choice
Given multi-step execution and cross-tool invocation, agents should, at key points such as first launch, permission changes, and tasks involving sensitive operations, inform users according to law of the scope, purpose, methods, and risks of personal information processing. Processing of sensitive personal information or transmission of personal information to third parties should obtain the user's separate consent or satisfy other conditions provided by laws and regulations. Consent should not be obtained through blanket authorization, default checkboxes, or unreasonable bundling.
Technical Protection
Organizations should build a personal information security protection system covering the full processing chain around risks that include prompt injection, unauthorized invocation, data leakage, model inversion, log leakage, and interface abuse. The initiative lists encryption, de-identification, anonymization, access permission controls, and operational security audit among the means to prevent leakage, tampering, loss, and misuse of personal information. For autonomous reasoning and external tool invocation, processing logs and dynamic risk monitoring should be established. When a personal information security incident occurs, organizations should take timely remedial measures as required by law, inform users, and report to departments that perform personal information protection duties.
Cooperation Chains and External Interfaces
Third-party plugins, external interfaces, toolchains, and knowledge bases should be subject to admission assessment, permission verification, and dynamic management, to prevent agents from obtaining personal information without authorization or processing it beyond scope during cross-system collaboration. Where entrusted processing, joint processing, or provision of personal information to other personal information processors is required, contracts or similar instruments should define each party's duties, permission boundaries, and security obligations. Review should occur before access, controls during access, and verification after access.
Memory Governance and Deletion Requests
Memory data formed through long-term interaction may retain user preferences, behavioral habits, identity characteristics, and other personal information. Agents should, according to how memory data are processed and according to product functions, provide users with appropriate functions to view, manage, and delete memory data, such as viewing, modifying, or deleting memory segments by topic or interaction scenario. After a user cancels an account, withdraws consent, or terminates service, related personal information should be deleted or anonymized in accordance with law. Corresponding deletion or anonymization mechanisms should cover backups, logs, memory vectors, inference caches, and copies retained by third parties, so that deletion requests receive a complete response.
User Rights and Complaint Channels
Agents should provide convenient ways for users to exercise rights and should clearly display the types, sources, use, and flow paths of collected personal information. Users should be supported in querying, copying, transferring, and deleting personal information according to law. Convenient complaint channels should be established, with processes for acceptance, verification, handling, feedback, and review. Except where laws and regulations provide otherwise, requests by users to exercise rights should be handled within 15 working days.
Special Groups and Graded Protection
Special personal information protection requirements for minors, older people, and other special groups should be strictly implemented. Agents that mainly provide services to minors should set a dedicated protection mode and strengthen security controls on collection, use, and memory retention of personal information. Agents facing older people are encouraged to improve interaction and notice methods, raise the prominence and understandability of notice content, and avoid excessive collection of personal information through agents.