China. Comprehensive data protection. Departmental rules
PI Compliance Audit MeasuresAdministrative Measures for Personal Information Protection Compliance Audits (个人信息保护合规审计管理办法)
In force
§1Summary
- Synopsis
Implements the PIPL requirement for regular compliance audits. Handlers of PI of over 10 million people must self-audit at least every two years, and regulators can order audits after serious incidents.
- Key themes
- Unique features
Mandatory periodic privacy audits are unusual among peer laws; regulator-ordered audits use external auditors at the handler's cost.
- SaaS relevance
Large consumer SaaS platforms in China must budget for biennial privacy audits.
§2Obligations
- DPO
- Conditional
§3Dates
- Key dates
- Adopted
- In force
§4Text and authority
- Text
- Authoritative text cac.gov.cn
- English text chinalawtranslate.com
- Authority
- Cyberspace Administration of China (CAC)
§5Where it applies
- Domestic law of
- China
§6Sources and verification
- Sources consulted
- Verification
High confidence.
Issue date given as February 2025 (exact day not confirmed). DPO needed above 1m individuals. [Link: official Chinese (CAC); CLT translation]