China Releases Administrative Measures for Personal Information Protection Compliance Audits

On February 12, 2025, the Cyberspace Administration of China (CAC) issued the Administrative Measures for Personal Information Protection Compliance Audits (the “Measures”), which will take effect on May 1, 2025.

The Measures, comprising 20 articles, define personal information protection compliance audit as a supervisory activity that reviews and evaluates whether the personal information processing activities of data processors comply with laws and administrative regulations. The Measures stipulate that if a data processor meets one of the three specified conditions, the relevant protection department may require the processor to engage a professional organization to conduct a compliance audit of its personal information processing activities. If a data processor conducts a compliance audit on its own or commissions a professional organization to do so in accordance with the protection department’s requirements, it must follow the Guidelines for Personal Information Protection Compliance Audits included in the Measures.