On 3 August 2023 the Cyberspace Administration of China published for public consultation the Measures for the Administration of Personal Information Protection Compliance Audits. The draft converts the duty of “regular compliance audits” under Article 54 of the Personal Information Protection Law from a principle into an executable frequency, subject and process.
For most companies the difficulty is not whether to audit but who conducts it, what it covers and how completion is evidenced. The answers in the draft are not complicated, but they are enough to change the rhythm of internal compliance work.
Who must audit, and how often
The draft tiers processors by scale. Those processing personal information of more than one million individuals must conduct a compliance audit at least once a year; those below that threshold at least once every two years. A processor handling data at different scales applies the higher standard.
Beyond periodic audits, event-driven audits exist. After a major leak, tampering or loss of personal information, or where a regulator identifies material risk in supervision, a processor may be required to conduct a targeted audit. Such audits usually have a fixed window, leaving far less preparation time than an annual audit.
Who conducts the audit
The audit may be performed by an internal unit or delegated to a professional institution. Internal audit is familiar with business processes and cost-controlled, but independence may be affected by reporting lines. External audit brings expertise and independence, but requires arrangements for data access, confidentiality and retention of audit evidence.
The draft imposes requirements on the qualifications, personnel and independence of professional institutions, and prohibits appointing an institution with a conflict of interest. For group companies, audit arrangements between parent and subsidiaries, and limits on consecutive engagements of the same institution, should be designed in advance.
What the audit covers
The audit examines lawfulness, legitimacy and necessity of processing, typically covering processing rules and notice-consent, joint and delegated processing, cross-border provision, automated decision-making, sensitive personal information, minors’ data, security incident handling, impact assessments and internal management systems.
The draft requires an audit report setting out basis, scope, method, findings and remediation recommendations. The report is not a one-off deliverable but the foundation for remediation and supervision. In a regulatory inspection, a record showing what was found, how it was corrected and how correction was verified is more persuasive than a report with no findings.
What companies can prepare now
First, map personal information processing activities into an activity list and data map. Second, confirm the applicable scale tier and set audit frequency and an annual plan. Third, decide whether the audit will be internal or external. Fourth, prepare evidence including privacy policies, consent records, processing agreements, cross-border pathways, incident records and training logs. Fifth, establish a remediation loop assigning owners, deadlines and verification.
An audit should not be treated as a one-off inspection. It is better understood as an annual systematic review of how rules and execution diverge.
For personal information protection and compliance audits, see our data compliance service; for audit planning and retained counsel, see annual legal counsel; for incident handling, see cybersecurity compliance.
This article is based on the draft Measures for the Administration of Personal Information Protection Compliance Audits published for consultation by the Cyberspace Administration of China on 3 August 2023. It is for reference only and does not constitute legal advice.