China PI Compliance Audit Measures
In force China · In force May 1, 2025 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Implements PIPL Arts. 54 and 64: PI processors must audit their own PIPL compliance regularly, and regulators can order an audit by a professional firm when they find high risk or an incident. Processors of PI of more than 10 million people must audit at least once every two years.
- Who it applies to
- All personal information processors in China; mandatory biennial audits for processors handling PI of more than 10 million individuals. The related CAC Q&A ties the DPO requirement to processors handling PI of 1 million+ individuals.
- Penalties
- Penalties are imposed under the PIPL (up to RMB 50 million or 5% of prior-year turnover for serious violations).
- Enforced by
- CAC and departments with PI protection duties
- Official name
- Administrative Measures for Personal Information Protection Compliance Audits (CAC Order No. 18)
- Citation
- CAC Order No. 18
- Topics
- privacy
Verified 2026-09-22 cac.gov.cn
Research notes
The measures fix no calendar date for the first biennial audit. The 1-million DPO threshold comes from the CAC announcement and law-firm summaries, not re-read in the official text here.
Related
Australia Privacy Act
India DPDP ActQuestions about China PI Compliance Audit Measures
- What are the China PI Compliance Audit Measures compliance deadlines?
- May 1, 2025: PI compliance audit measures take effect.
- When does China PI Compliance Audit Measures take effect?
- China PI Compliance Audit Measures took effect on May 1, 2025.
- Who does China PI Compliance Audit Measures apply to?
- All personal information processors in China; mandatory biennial audits for processors handling PI of more than 10 million individuals. The related CAC Q&A ties the DPO requirement to processors handling PI of 1 million+ individuals.
- What are the penalties under China PI Compliance Audit Measures?
- Penalties are imposed under the PIPL (up to RMB 50 million or 5% of prior-year turnover for serious violations).