China enacts new rules for personal information audits

The Cyberspace Administration of China’s (CAC) new Measures for Personal Information Protection Compliance Audits were finalized in February and took effect this month. These measures, together with additional regulations, form China’s compliance audit system, which is mandatory under the Personal Information Protection Law (PIPL). 

‍

Audits may be self-initiated or regulator-mandated, as processors managing personal information of more than 10 million individuals are required to conduct an audit every two years. If a security incident occurs or the regulator suspects a high risk to user data, the company may need to conduct the audit through a professional agency. 

‍