China: Closed consultation on Administrative Measures for Personal Information Protection Compliance Audit including operating conditions

Description

Closed consultation on Administrative Measures for Personal Information Protection Compliance Audit including operating conditions

On 2 September 2023, the Cyberspace Administration of China (CAC) closed its consultation on the draft Administrative Measures for Personal Information Protection Compliance Audit. The proposed Measures would require service providers processing personal information on more than 1 million people to conduct compliance audits at least once a year, and service providers with less than 1 million users at least every 2 years. Authorities can require organisations found to have faulty personal information handling processes to undergo further audits. Audits, which can be done internally or by third parties, should evaluate compliance with consent, notice, sharing, storage, security, and other requirements in China's Personal Information Protection Law. The results must generally be submitted to regulatory authorities within 90 days and organisations must rectify the issues identified. Large internet platforms have specific auditing requirements regarding their rules, oversight of platform vendors, annual social responsibility reports, and independent personal information oversight bodies.

Original source

Scope

Policy Area
Other operating conditions
Policy Instrument
Other operating condition, nes
Regulated Economic Activity
cross-cutting
Implementation Level
national
Government Branch
executive
Government Body
other regulatory body

Complete timeline of this policy change

Hide details
2023-08-03
in consultation

On 3 August 2023, the Cyberspace Administration of China (CAC) opened a consultation on the draft A…

2023-09-02
processing consultation

On 2 September 2023, the Cyberspace Administration of China (CAC) closed its consultation on the dr…

2024-05-20
adopted

On 20 May 2024, the Cyberspace Administration of China (CAC) approved the Measures for the Administ…

2025-02-12
in grace period

On 12 February 2025, the Cyberspace Administration of China (CAC) released the Measures for the Adm…

2025-05-01
in force

On 1 May 2025, the Cyberspace Administration of China (CAC)’s Measures for the Administration of Co…

We use cookies and other technologies to perform analytics on our website. By opting in, you consent to the use by us and our third-party partners of cookies and data gathered from your use of our platform. See our Privacy Policy to learn more about the use of data and your rights.