China's Personal Information Protection Compliance Audit: Nature And Strategy

On February 12, 2025, the Cyberspace Administration of China (CAC) issued the Rules on Compliance Audit for Personal Information Protection (PIPCA Rules) to implement the compliance audit requirements under the Personal Information Protection Law (PIPL) and the Regulation on Network Data Security Administration (Network Data Regulation). The PIPCA will come into effect on May 1, 2025.

Following the release of the PIPCA Rules, on March 3, 2025, the Secretariat of the National Cybersecurity Standardization Technical Committee published the Guideline for Cybersecurity Standards Practice - Requirements for Professional Institution's Service Capabilities in Personal Information Protection Compliance Audits (draft for comments), (Requirements for PIPCA Professional Competencies). The deadline for public comments is March 17, 2025.