On 3 August 2023, the Cyberspace Administration of China (CAC)
released the Management Measures for Compliance Audits on
Personal Information Protection (Draft for Comments). These
Compliance Audit Measures, once adopted, will
oblige all companies in China that handle personal
information (PI), to complete regular audits on whether personal
information is processed in accordance with the PRC Personal
Information Protection Law (PIPL).
Key points of the draft include:
- Compliance audit requirements. A
PI handler that processes PI of more than one
million individuals is required to conduct a compliance audit at
least once per year, while all other PI handlers
are required to conduct a compliance audit every two
years. Regulatory authorities may also require PI handlers
to conduct compliance audits in the event of a security incident or
when there is a significant risk in their PI processing
activities.
