On February 12, 2025, the Cyberspace Administration of China (CAC) issued the Administrative Measures for Compliance Audits on Personal Information Protection (hereinafter referred to as the “Measures”). Scheduled to take effect on May 1, 2025, the Measures establish a comprehensive framework for conducting compliance audits related to personal information protection. They detail requirements for self-conducted audits, regulatory-mandated audits, obligations of personal information processors, and the responsibilities of professional auditing institutions. Key Provisions of the Measures include:

Mandatory Compliance Audits:

-  Companies processing the personal data of more than 10 million individuals are required to conduct compliance audits at least once every two years.

-  Entities identified by regulatory authorities as posing potential data security risks may be subject to additional mandatory audits.

Compliance Reporting and Rectification:

Businesses must complete audits within specified timeframes and address any identified compliance gaps in line with regulatory requirements.

Audit Guidelines:

The Measures reference an upcoming national standard (Data Security Technology – Personal Information Protection Compliance Audit Requirements), which will provide detailed guidance on conducting audits.

Context and Implications:

Regular compliance audits for personal information protection are a mandatory obligation for personal information processors under China’s Personal Information Protection Law and the Regulations on Network Data Security Management. While the Measures primarily target personal information processors, overseas mobile machinery manufacturers operating in China should evaluate their data processing activities to ensure compliance. Companies involved in collecting, storing, or processing personal data—such as customer information, telematics data, or location-based services—must stay informed about their obligations under China’s evolving regulatory landscape.

If you have any questions or need further assistance, please reach us at: info@bestao-consulting.com.

BESTAO presents free monthly report on China compliance. It offers a comprehensive solution on observing various standards and regulatory activities in China. Sample of the monthly report please refer to：

https://www.bestao-consulting.com/detail?id=1740&status=bestao_library

Subscribe the free monthly report by register as a BESTAO website member at: https://www.bestao-consulting.com/login, or write an email to assistant@bestao-consulting.com.