In February 2025 the Cyberspace Administration of China published measures on personal information protection compliance audits, effective 1 May 2025. The measures move personal information protection from “having a system” to “verifying that the system actually runs”, creating a periodic obligation that can be checked.
Two triggers
The measures set two main triggers.
First, routine audits. A processor handling personal information of more than 10 million people must carry out a personal information protection compliance audit at least once every two years. The threshold concentrates the obligation on larger platform companies rather than all processors.
Second, incident-triggered audits. Where a security incident causes the leakage, tampering, loss or destruction of personal information of more than one million people, or sensitive personal information of more than 100,000 people, regulators may require the processor to commission a compliance audit by a professional institution. This type of audit has the character of a post-incident review, focused on gaps in design and execution. See our notes on obligations of major personal information processors.
Audit versus self-check
A compliance audit is not the same as an internal self-check. Because the measures allow and in certain cases require commissioning a professional institution, the audit needs a degree of independence, method and documented conclusions. For companies this means records, logs and policy texts have to be kept continuously during operations, rather than assembled when an audit begins.
For companies above the 10 million threshold, audit preparation should be treated as routine work. See our notes on simplified measures for small processors and on certification for outbound personal information.
How it fits the wider data compliance system
The audit is not a standalone requirement. It sits alongside data classification, cross-border transfer and incident response in the operational layer of personal information protection. Its effectiveness depends on the upstream work: if the inventory of processing activities, the authorisation chain and retention records are incomplete, the audit cannot reach meaningful conclusions. See our notes on the network data security regulation.
In practice, the earlier a company turns the underlying materials into a maintainable ledger, the lower the compliance cost later. Treating the audit as a one-off project tends to cost more in the second and third rounds.
This article is based on the Cyberspace Administration of China’s measures on personal information protection compliance audits and public information and is for reference only; it does not constitute legal advice.