New Rules On Personal Information Protection Audit Issued By CAC

On February 12, 2025, the Cyberspace Administration of China ("CAC") issued the Measures for the Administration of Personal Information Compliance Audit (the "Audit Measures"), which will take effect from May 1, 2025. The draft of the Audit Measures was first released for solicitation of public comments on August 3, 2023, and it took a year and a half for CAC to finalize the Audit Measures. In the final version of the Audit Measures, there are a few notable changes compared with the draft version, which reflect the evolving and more relaxed data protection regulatory stance of the CAC.

The Audit Measures are detailed rules for the implementation of the general requirements for personal information protection compliance audits stipulated under the Personal Information Protection Law of the PRC (the "PIPL") and the Regulations on the Administration of Network Data Security (the "Network Data Security Regulations", which took effect from January 1, 2025). Under the