China has enacted a major new regulatory framework that expands data privacy oversight for companies handling large volumes of personal data. Effective today, the Measures for the Administration of Personal Information Protection Compliance Audits require any organization processing the personal information of more than 10 million individuals to conduct formal audits every two years. The rules apply to both domestic and foreign companies operating in China and represent a significant evolution of the country’s personal data governance regime.
Mandatory Audits and Broader Oversight
The new requirements build upon China’s Personal Information Protection Law (PIPL) and Data Security Law, which laid the groundwork for regulating personal data processing and cross-border transfers. Under the updated rules, large-scale data processors must conduct internal or third-party audits every two years to ensure full compliance with China’s data protection standards. The audits must assess legal grounds for data collection, consent management, data minimization, retention limits, protection of data subject rights, and overall risk controls.
Smaller organizations—those handling fewer than 10 million records—are not exempt. While not subject to the biennial mandate, they are still expected to conduct regular self-assessments under the PIPL. Additionally, the Cyberspace Administration of China (CAC) may compel any organization, regardless of size, to undergo an audit in cases involving suspected violations, data breaches, or systemic risks.
Enforcement, Sectoral Impact, and Global Relevance
Failure to comply can result in substantial penalties. Companies may face fines of up to 50 million yuan or 5 percent of annual revenue, operational suspensions, business license revocations, or even criminal charges in severe cases. The CAC will conduct its own inspections to ensure compliance and may publicly name violators as part of its enforcement strategy.
The audit obligations especially impact sectors like technology, finance, and healthcare, which routinely manage vast quantities of personal data. Affected organizations are expected to allocate additional resources toward legal review, staff training, and technical infrastructure to comply with the expanded regulations. Some global firms are already working with local auditors and legal teams to prepare for oversight measures.
In addition to audit requirements, the measures support broader initiatives to strengthen digital identity verification and curb intrusive surveillance practices. Last month, regulators banned the mandatory use of facial recognition for business identity checks—a move widely seen as part of China’s growing emphasis on digital rights and data minimization.
The finalized rules include notable relaxations compared to earlier drafts. The threshold for mandatory audits was raised from 1 million to 10 million individuals, and the audit frequency was reduced from annually to biennially. Still, companies must comply with extensive obligations, including appointment of data protection officers, publishing social responsibility reports, and securing cross-border transfers through government-approved channels when handling sensitive or important data.
Sources: China Daily, Global Times, Arnold & Porter
—
May 1, 2025 – by Ali Nassar-Smith
