The Measures for the Administration of Personal Information Protection Compliance Audits (Cyberspace Administration of China Order No. 18) were promulgated on February 12, 2025 and took effect on May 1, 2025. The Measures and their annex, the Guidelines for Personal Information Protection Compliance Audits, set out detailed rules for Articles Fifty-Four and Sixty-Four of the Personal Information Protection Law. Processors must conduct audits regularly, and those processing the personal information of more than 1000 wan (ten million) individuals must do so at least once every two years. In three categories of circumstances, regulators may require processors to engage a professional institution to conduct an audit.
A server room at the European Organization for Nuclear Research (CERN), photographed on January 14, 2009. It is used only to illustrate a data-processing setting. Photo: Torkild Retvedt; source: Flickr; license: CC BY-SA 2.0.
Basis in Higher-Level Law and Scope of Application
Compliance audits are not a new obligation created by the Measures. Article Fifty-Four of the Personal Information Protection Law (adopted on August 20, 2021 and effective from November 1, 2021) provides that personal information processors shall regularly audit whether their processing of personal information complies with laws and administrative regulations. Article Sixty-Four applies where departments performing personal information protection duties find that processing activities carry relatively high risks or that a personal information security incident has occurred. In those cases, the departments may summon the processor's legal representative or principal person in charge for a regulatory interview, or require the processor to engage a professional institution to conduct a compliance audit. The processor shall then rectify as required and eliminate hidden risks. Article One of the Measures names the Personal Information Protection Law, the Regulations on Network Data Security Management and other laws and administrative regulations as its legal basis. The CAC's press release describes the Measures as providing detailed rules on how audits are conducted, how audit institutions are selected, how often audits take place, and what obligations processors and professional institutions bear.
Under Article Two, the Measures apply to personal information protection compliance audits carried out within the territory of the People's Republic of China. A compliance audit is defined as a supervisory activity that reviews and evaluates whether a personal information processor's processing activities comply with laws and administrative regulations. Article Nineteen excludes state organs and organizations authorized by laws and regulations to perform public-affairs management functions. The Measures were deliberated and adopted at the Cyberspace Administration of China's 15th office meeting of 2024 on May 20, 2024. They were promulgated on February 12, 2025 and published on the China Cyberspace website on February 14. Article Twenty provides that they take effect on May 1, 2025.
Exterior of the Great Hall of the People in Beijing. The Personal Information Protection Law was adopted by the Standing Committee of the National People's Congress on August 20, 2021. Photo: Arian Zwegers; source: Flickr; license: CC BY 2.0.
Self-Initiated Audits and Commissioned Audits
The Measures distinguish between two ways of initiating an audit. In the first, the processor initiates the audit itself. Article Three provides that audits are conducted regularly either by the processor's internal body or by a professional institution it engages. In other words, a self-initiated audit can still be carried out by an outside institution. Article Four provides that processors handling the personal information of more than 1000 wan (ten million) individuals shall conduct an audit at least once every two years. For processors below this scale, the Measures set no separate frequency. The “regularly” requirement in Article Three and in Article Fifty-Four of the Personal Information Protection Law applies instead. The official texts do not explain how the number of individuals is to be calculated or when the first two-year cycle begins.
In the second, the processor engages a professional institution at a regulator's request. Under Article Five, the national cyberspace authority and other departments performing personal information protection duties (collectively referred to in the Measures as “protection authorities”) may require a processor to engage a professional institution to conduct an audit in any of the following circumstances: they find that processing activities carry relatively high risks, such as seriously affecting individuals' rights and interests or seriously lacking security measures; processing activities may infringe the rights and interests of a large number of individuals; or a personal information security incident occurs that results in the leakage, tampering, loss or destruction of the personal information of 100 wan (one million) or more individuals or of the sensitive personal information of 10 wan (one hundred thousand) or more individuals. This requirement may not be imposed more than once for the same security incident or risk.
Processors required to undergo an audit must also fulfill a set of procedural obligations. They must provide necessary support to the professional institution and bear the audit costs (Article Eight). They must select a professional institution as the protection authority requires and complete the audit within the prescribed time, which may be reasonably extended with approval in complex cases (Article Nine). Once the audit is complete, they must submit an audit report signed by the professional institution's principal person in charge and by the person in charge of the compliance audit, and bearing the institution's official seal (Article Ten). They must also rectify as required and submit a report on the rectification within 15 working days after it is completed (Article Eleven). Whichever approach is used, Article Six requires reference to the annexed Guidelines for Personal Information Protection Compliance Audits.
Article Twelve assigns responsibility for audits within the organization. Processors handling the personal information of 100 wan (one million) or more individuals shall designate a person in charge of personal information protection to oversee compliance audit work. Processors that provide important internet platform services, have a very large number of users and operate complex types of business shall establish an independent body composed mainly of external members to supervise compliance audits. These two requirements connect, respectively, to Article Fifty-Two (person in charge of personal information protection) and Article Fifty-Eight (independent supervisory body for large platforms) of the Personal Information Protection Law. Articles Sixteen to Eighteen further cover supervision and inspection by the protection authorities and complaints and reports. They also provide that violations of the Measures are handled in accordance with the Personal Information Protection Law, the Regulations on Network Data Security Management and other laws and regulations.
Obligations of Professional Institutions
The Measures impose four sets of requirements on professional institutions that undertake audits. Article Seven requires them to have audit capability, with audit personnel, premises, facilities and funds commensurate with their services. It also encourages them to obtain certification, which is carried out in accordance with the Regulations of the People's Republic of China on Certification and Accreditation. Article Thirteen requires them to abide by laws and regulations, act with honesty and integrity, and make professional judgments fairly and objectively. They must keep confidential, in accordance with the law, any personal information, trade secrets and confidential business information obtained in performing their duties, and promptly delete the relevant information after the audit ends. Article Fourteen prohibits them from subcontracting audits to other institutions. Article Fifteen provides that the same professional institution and its affiliates, or the same person in charge of a compliance audit, may not audit the same audit subject three or more consecutive times.
After the Measures took effect, the CAC answered reporters' questions on implementation matters on May 27, 2025, and described the supporting arrangements. The Secretariat of the National Cybersecurity Standardization Technical Committee has issued the Cybersecurity Standard Practice Guide — Requirements for Personal Information Protection Compliance Audits, which standardizes the audit process, audit content and methods, audit evidence, working-paper templates and report templates. The CAC Data and Technology Support Center, the China Cybersecurity Review, Certification and Market Regulation Big Data Center, and Beijing CESI Certification Co., Ltd. (3 organizations in total) have filed their certification rules with the Certification and Accreditation Administration, and professional institutions may apply to them for certification. Audit personnel are divided into three levels, namely junior, intermediate and senior, and the Cyber Security Association of China has compiled key points for evaluating their competency. These are supporting documents, not provisions of the Measures themselves.
Key Items in the Audit Guidelines
The annexed Guidelines for Personal Information Protection Compliance Audits contain twenty-seven items in total, which list key review matters by processing stage. The items cover the legal basis for processing; processing rules and notification; joint processing; entrusted processing; transfers of personal information resulting from mergers, divisions and similar events; provision to other processors; automated decision-making; public disclosure of personal information; image collection and personal identification equipment in public places; processing of personal information that has already been made public; sensitive personal information; personal information of minors under the age of fourteen; provision outside the country; the right to deletion and the protection of other individual rights; internal management systems; security technical measures; education and training; performance of duties by the person in charge of personal information protection; personal information protection impact assessments; and security incident contingency plans and emergency response. The last two items concern platform rules and personal information protection social responsibility reports for large platforms. Item fifteen sets numerical thresholds for cross-border provision. For example, if a processor other than a critical information infrastructure operator has, since January 1 of the current year, cumulatively provided outside the country the personal information (excluding sensitive personal information) of 100 wan (one million) or more individuals, or the sensitive personal information of 1 wan (ten thousand) or more individuals, the audit examines whether the processor has passed a security assessment organized by the national cyberspace authority.
The item most directly relevant to AI applications is item nine, “Use of automated decision-making to process personal information,” which contains seven review points: the transparency of automated decision-making and whether its results are fair and just; whether the processor notified individuals in advance of the types of personal information processed and the possible impacts; whether a personal information protection impact assessment was conducted in advance; whether safeguard mechanisms allow individuals to refuse, through convenient means, decisions made through automated decision-making that significantly affect their rights and interests, and to require the processor to explain them; whether information push services and commercial marketing also offer options not targeted at personal characteristics, or a convenient way to refuse; whether effective measures are taken to prevent unreasonable differential treatment in transaction terms based on consumers' preferences, transaction habits and similar factors; and other matters that may affect transparency or the fairness and justice of results. These review points correspond mainly to Article Twenty-Four of the Personal Information Protection Law. They also relate to Article Fifty-Five, which lists “using personal information for automated decision-making” among the circumstances that require a prior impact assessment. Article Seventy-Three of the same law defines automated decision-making as the activity of using computer programs to automatically analyze and assess an individual's behavioral habits, hobbies and interests, or economic, health or credit status and the like, and to make decisions.
In terms of structure, the Measures themselves contain only twenty articles. They mainly address who conducts audits, how often audits are conducted and how audit institutions perform their duties. The question of “what to audit” is addressed mainly in the annexed Guidelines. Most review points in the Guidelines correspond to provisions of the Personal Information Protection Law, so the Guidelines read more like existing obligations rewritten as an audit checklist. The specific audit procedures and evidence requirements are set out in the practice guide mentioned above. This account of how the provisions relate to one another is the author's own analysis.
References
-
Cyberspace Administration of China: Measures for the Administration of Personal Information Protection Compliance Audits (Cyberspace Administration of China Order No. 18), promulgated on February 12, 2025, published on the China Cyberspace website on February 14, 2025, effective from May 1, 2025.
-
China Cyberspace website: Cyberspace Administration of China Promulgates the Measures for the Administration of Personal Information Protection Compliance Audits, February 14, 2025.
-
China Cyberspace website: Answers to Reporters' Questions on Matters Concerning the Implementation of the Measures for the Administration of Personal Information Protection Compliance Audits, May 27, 2025.
-
Standing Committee of the National People's Congress: Personal Information Protection Law of the People's Republic of China, adopted on August 20, 2021, effective from November 1, 2021.
-
Xishu Zhifa · Law is the art of the rules of the game
-
This information was compiled and published by Scholay, a one-stop academic platform. If it infringes any rights, please let us know and it will be taken down.
-
Also published on Enter Scholar, a community for scholars in the age of intelligence